Terrorist group counterintelligence
-
Upload
nguyenkhanh -
Category
Documents
-
view
245 -
download
9
Transcript of Terrorist group counterintelligence
TERRORIST GROUP COUNTERINTELLIGENCE
A Dissertation submitted to the Faculty of the
Graduate School of Arts and Sciences of Georgetown University
in partial fulfillment of the requirements for the degree of
Doctor of Philosophy In Political Science
By
Blake William Mobley, M.A.
Washington, DC October 20, 2008
ii
Copyright 2008 by Blake William Mobley All Rights Reserved
iii
TERRORIST GROUP COUNTERINTELLIGENCE
Blake W. Mobley, M.A.
Thesis Advisor: Daniel L. Byman, Ph.D.
ABSTRACT
Most terrorist groups do not survive past their first few years of existence. All
terrorist groups, even those that survive for decades, face a basic and constant existential
threat: discovery of their activities, personnel, and plans by government law enforcement
and intelligence agencies. Why do some terrorist groups manage this threat better than
others? What accounts for the variation in terrorist group counterintelligence
capabilities? Answers to these questions have profound implications for homeland
security and international counterterrorism efforts.
The study examines how three core variables: a terrorist group's organizational
structure, its access to controlled territory and its level of popular support, affect the
terrorist group’s counterintelligence strengths and vulnerabilities. Thirty-three terrorist
groups are examined in a large typological framework while additional case studies
provide an in-depth focus on Al Qaeda, the Provisional Irish Republican Army (PIRA),
Fatah, Black September, and the Egyptian Islamic Group (Gemaa al-Islamiyya).
The study shows that terrorist groups inevitably face predictable, though often
subtle, counterintelligence dilemmas that challenge their ability to function effectively.
Contrary to popular belief, the dissertation shows that hierarchical and tightly organized
terrorist organizations are frequently superior to decentralized or ‘network’ terrorist
iv
organizations in their counterintelligence capabilities, and therefore are in many cases
better suited for long-term survival. Additionally, the study shows that most terrorist
group leaders crave publicity, which frequently undermines the terrorist group’s need to
maintain secrecy and security. This research offers numerous policy prescriptions for
more efficiently exploiting terrorist counterintelligence vulnerabilities. Incorporating
these insights into current counterterrorism efforts promises to add inventive methods for
monitoring and eliminating terrorist groups.
v
TABLE OF CONTENTS
Chapter One: Introduction to Terrorist Group Counterintelligence................................... 1
Chapter Two: The Provisional Irish Republican Army.................................................... 54
Chapter Three: Fatah and Black September………....................................................... 125
Chapter Four: Al Qaeda………………….………......................................................... 195
Chapter Five: The Egyptian Islamic Group………........................................................ 306
Chapter Six: Terrorism and Counterintelligence………................................................ 347
Bibliography................................................................................................................... 386
1
CHAPTER ONE: INTRODUCTION TO TERRORIST GROUP COUNTERINTELLIGENCE
Only half of all terrorist groups survive their first year of existence and only five
percent survive their first decade.1 Terrorist groups “end” for a variety reasons. Some
lose key leaders, while others transition to non-violent political entities or fail to pass
their cause on to the next generation of terrorists.2 Almost all terrorist groups face a more
basic and daily threat to their survival—discovery of their activities, personnel and plans
by government law enforcement and intelligence agencies. Groups that fail to hide their
communications, movements, and plots from a determined adversary will be quickly
eliminated. Terrorist groups that survive for years often do so because they have
developed sophisticated methods for staying hidden. Such strategies are often referred to
as counterintelligence. Intelligence and counterintelligence often play a vital role in how
terrorist groups end and how clandestine armed organizations adapt to existential threats.
Most studies of terrorist groups omit analysis of these critical variables and, importantly,
most groups that experience crippling counterintelligence problems do not survive long
enough to be studied at all.
What accounts for the variation in terrorist group counterintelligence capabilities?
Why do some groups adopt sophisticated counterintelligence procedures while others
fail? Understanding terrorist group counterintelligence is critical for several reasons.
1 Bruce Hoffman, “The Modern Terrorist Mindset,” In Terrorism and Counterterrorism: Understanding the New Security Environment, ed. RD Howard, RL Sawyer. (Guilford CT: McGraw Hill, 2002): 84. 2 Audrey Cronin, “How Al Qaida Ends: The Decline and Demise of Terrorist Groups.” International Security, (Summer 2006).
2
First, anticipating terrorist counterintelligence vulnerabilities will enable governments to
more effectively monitor and dismantle terrorist groups. Second, correctly diagnosing a
terrorist group’s counterintelligence capabilities may produce insight into the group’s
size, command structure, budget, access to state sponsors, and ability to adapt to its
adversary’s counterterrorism initiatives.
The literature on intelligence and terrorism offers limited insights into terrorist
group counterintelligence. A large portion of terrorism literature focuses on terrorist
group motivations, decision-making and government policy responses. The intelligence
literature consists mainly of firsthand accounts of intelligence practitioners and large
scale appraisals of the intelligence community and intelligence reform. Very few studies
attempt to carefully examine and theorize about the operational side of intelligence and
terrorist group intelligence operations in particular. This study attempts to address this
deficit in the literature. To the terrorism literature it adds a unique framework for
predicting terrorist group behavior, decision-making and strategy. Importantly, the study
shows that terrorist groups inevitably face counterintelligence dilemmas that challenge
their ability function effectively. The study also contributes to the intelligence literature
by developing a typological framework that allows for a more systematic examination of
counterintelligence strategies in variety of organizations.
Specifically, the study explores how three core independent variables affect a
terrorist group’s counterintelligence capabilities. These core variables are organizational
structure, popular support, and controlled territory. The study also includes two
important control variables, the counterterrorism capabilities of the group’s adversary and
3
the terrorist group’s resources.3 The study argues that changes in the core variables lead
to specific counterintelligence and security tradeoffs for terrorist groups. Understanding
why and predicting when these tradeoffs arise will allow government law enforcement
and intelligence agencies to better detect and exploit them.
The first section of this introductory chapter provides a definition of key terms.
The second section situates the investigation of terrorist group counterintelligence in the
broader literatures of organizational theory, terrorism and insurgency. The third and
fourth sections of the introductory chapter detail the hypotheses and alternative
hypotheses to be examined in the study. The fifth section discusses how each of the
variables will be measured and the challenges of measurement. The sixth section
provides an explanation of how insights from the study will improve theorizing and
contribute to the broader literature. The seventh and eighth sections introduce the terrorist
counterintelligence typology and then test the hypotheses against thirty-three terrorist
group cases. The final section of the introductory chapter outlines the four in-depth case
studies that constitute the remainder of the study and explains why these cases in
particular were selected.
Section One: Defining Terms
Definitions of the three key concepts of the study—terrorism, intelligence and
counterintelligence—are frequently debated in the literature. The study does not seek to
3 While these two variables are not addressed directly in the hypotheses, their effect on terrorist group behavior is substantial. Therefore, one of the goals of the study is to hold these variables constant while the values of the core variables shift and the independent variables are measured. By doing this, the study will isolate the effects of the core variables on the independent variables.
4
resolve controversies around these definitions. Rather, the following definitions are
selected to allow for a broad application of the study’s insights into both theory and
practice.
Using Bruce Hoffman’s definition of terrorism, a terrorist group has the following
characteristics: a sub-national group or non-state entity that uses violence or threatens
violence, whose goals are political and whose actions are designed to have far-reaching
psychological repercussions beyond the immediate victim or target.4 In contrast,
insurgency is defined as a struggle of a weaker party against a far stronger adversary,
using political resources and violence to upset the ‘illegitimate’ political system and
political authority of the stronger party.5 Insurgency stresses mobilization of mass
support for an overarching political goal, while terrorism stresses violence, against
combatants and noncombatants, to create a mood of fear for political ends.6
Terrorist counterintelligence is the process by which a terrorist group prevents its
adversaries from acquiring accurate information about its activities, personnel and plans.
A group can do this by concealing its activities or by surreptitiously supplying its
adversary with misinformation about the group’s activities.
4 Bruce Hoffman, Inside Terrorism, (Victor Gollancz, London: 1998): 43. 5 Bard O’Neill, “Insurgency: A Framework for Analysis,” in Insurgency in the Modern World, eds. Bard O’Neill, William Heaton, Donald Alberts (Boulder: Westview Press, 1980): 1. 6 To keep the scope of this study narrowly focused on the behavior of terrorist groups, the study will only incorporate insights from insurgencies that are widely seen as terrorist groups.
5
Defining intelligence is also essential for this study. Intelligence will be defined
as the collection, analysis, and dissemination of information on behalf of national security
decision makers or organizational leaders.7
Section Two: Terrorist Groups and Counterintelligence in the Literature
The following literature review introduces the broad theoretical themes and
concepts that shape the hypotheses and alternative hypotheses presented in the third
section. The first section of the literature review addresses the three core hypotheses: (1)
organizational structure, (2) political organizations and popular support, and (3)
controlled territory and geography of insurgency. The second section addresses the
primary control variables: the adversary’s counterterrorism capabilities, and terrorist
group resources and state sponsorship.8 The third section reviews two topic areas that
impact the core hypotheses: the literature on secret societies, and the literature on
misconduct and betrayal in organizations.
Organizational Structure
An organization’s internal structure significantly affects its decision-making
process and ability to achieve its goals. Organizational structures vary in numerous
ways, though the literature on organizational theory focuses on centralization
(concentration of decision-making authority), spans of control (number of subordinates
per supervisor), formalization (number of rules, regulations and procedures), complexity
7 Jennifer Sims, “Understanding Friends and Enemies: The Context for American Intelligence Reform,” in Transforming U.S. Intelligence, (eds) Jennifer Sims and Burton Gerber, (Georgetown University Press, DC, 2005): 15. 8 As will be explained in greater detail, the control variables will be held constant, when possible, to ensure that changes in the independent variables are the primary cause of variation in the dependent variables.
6
(number of occupational specialties represented) and administrative intensity (number of
support personnel within the system).910
Each of these variables undoubtedly plays a role in terrorist group organizational
structure. Perhaps the most interesting among these variables is centralization.
Centralization describes how much power group leaders have over their subordinates in
the organization and how effective group leaders are at shaping the behavior of
subordinates. For the purposes of this study, groups that are highly centralized—with
group leaders exercising a large degree of control over subordinates—will be referred to
as ‘tightly commanded.’11
In tightly commanded organizations leaders exercise strategic, operational and
tactical control over their personnel. In loosely commanded organizations leaders
exercise mainly strategic control over group personnel, affording lower ranking members
a greater degree of decision-making autonomy.12 Strategic control is the ability to define
top-level goals and aims of the group. Operational control is the ability to influence the
9 Bobbitt, Randolph H. Jr, and Orlando Behling, “Organizational Behavior: A Review of the Literature”, The Journal of Higher Education, (Vol 52, No 1, Jan – Feb 1981): 35. / Johnson, Norman J., Richard H Hall, J. Eugene Haas, “Organizational Size, Complexity and Formalization”, American Sociological Review, (Vol 32, No 6, Dec 1967): 905. 10 Theorizing on organizational complexity and ‘normal accidents’ is among of the central debates in the organizational literature. Charles Perrow’s work suggests that a terrorist group (as a complex organization) would be more likely to suffer from catastrophic CI accidents as the group requires tight coordination between sub-units (which are increasing mismatched as the sub-units’ modus operandi undergo “practical drift” over time) [Perrow 1984/Snook 2000]. However, finding examples of terrorist groups whose organizational complexity created catastrophic friction with the group’s need for tight coupling between organizational units has proven extremely difficult. 11 Brian Jackson, “Groups, Networks or Movements: A Command and Control Driven Approach to Classifying Terrorist Organizations and its Applications to Al Qaeda,” Studies in Conflict and Terrorism, (Vol 29, 2006): 243. 12 Ibid.
7
activities and operations being carried out in pursuit of the organization’s strategic goals.
Tactical control is the ability to influence the specific activities an individual member or
component of the organization carries out on a day-to-day basis.13 The following
subsection helps to develop the study’s hypothesis on organizational structure by linking
theoretical insights to terrorist group counterintelligence.
Organizational Structure and Counterintelligence. Organizational theorists tend
to agree that tight command and control structures improve strategic coordination but
reduce local adaptation and tactical innovation.14 This insight will serve as an anchor for
the hypotheses about counterintelligence in organizations. Strategic coordination will be
beneficial for many intelligence tasks, including coordinating intelligence collection,
sharing intelligence across geographical and organizational units, and alerting the group
to general counterintelligence threats. On the other hand, high levels of strategic
coordination can also create counterintelligence vulnerabilities for a terrorist group.
Strategic coordination discourages innovation and potentially useful variation within the
organization. The Basque terrorist group ETA, for example, trained all its recruits to
evade government surveillance by communicating with couriers and anonymous
exchange points, known as ‘dead drops’, rather than landline telephones and the postal
13 Ibid. / It is important to note that most terrorist groups will not be perfectly tightly-or loosely-commanded. Instead, groups will fit somewhere on the spectrum in between these extremes and, as a result, will be subject to a mixture of advantages and vulnerabilities that come with each command structure. 14 Russ Marion and Mary Uhl-Bien, Complexity Theory and al Qaeda: Examining Complex Leadership, Presented at Managing the Complex IV: A Conference on Complex Systems and the Management of Organizations, (Fort Meyers, FL, December, 2002). Available at: sce.edu/ISCE_Group_Site/web-content/ISCE%20Events/ Naples_2002/Naples_2002_Papers/Marion_Uhl-Bien.pdf ; Jackson, 247. Kauffman, S.A. (1993), The Origins of Order. New York: Oxford University Press.
8
service. As a result, however, Spanish police could more easily identify ETA couriers—
and perhaps ETA personnel and facilities—by studying the standardized methods of a
subset of the group’s couriers.
Strategic coordination is also required for implementing an organizational
strategy known as compartmentation—the process restricting the flow of information
within an organization to prevent the disclosure of sensitive intelligence to individuals
who are not authorized to receive such information. For an organization to achieve
compartmentation without fragmenting itself into many autonomous groups, a higher
degree of coordination at upper levels of the organization are required to compensate for
reduced communication and information flow at lower-levels.15 For example, when
Italian police began to rout the Italian Red Brigades in the mid 1970s, the Brigades
established a rigid territorial hierarchy to facilitate the creation of a highly
compartmented structure among their operational cells.16
These insights lead to the first two organizational hypothesis. Hypothesis 1(A): A
terrorist group with a tight command and control structure, relative to a group with a
loose command structure, will have superior counterintelligence training and
compartmentation. Hypothesis 1(B): A terrorist group with a tight command and control
structure, relative to a group with a loose command structure, will be more vulnerable to
15 Wayne E. Baker, Robert R. Faulkner, “The Social Organization of Conspiracy: Illegal Networks in the Heavy Electrical Equipment Industry,” American Sociological Review, (Vol 58, No. 6, Dec., 1993): 848. And G.H. McCormick and G. Owen, “Security and Coordination in a Clandestine Organization,” Mathematical and Computer Modelling 31 (2000): 176. 16 Robert Meade, Jr. Red Brigades: The Story of Italian Terrorism, (MacMillan: London, 1990): 51, 95.
9
its adversary’s efforts to develop high-level penetrations and exploit the group’s
standardized counterintelligence procedures. Organizational theorists have developed
these basic insights about centralization, coordination and innovation from studying a
variety of ‘normal’ organizations, but will these principles extend to terrorist groups as
well? Demonstrating that this phenomenon may apply to terrorist groups offers evidence
of its universality, and perhaps the applicability of similar organizational theorizing to a
larger variety of terrorist group behavior.
Organizational theorists also hypothesize about how an organization’s
environment affects its internal structure. The threat-rigidity hypothesis, developed by
Staw et al, posits that external threats lead to centralization and constriction of control—
and consequently to rigidity in organizational responses and restriction in information
processing.17 Centralization is characterized by a decline in the number of participants in
decisions and an increase in decision-making control at upper levels of the organization.
The literature suggests that rigidity in response may be adaptive if causal relationship
between process and performance is stable but maladaptive if the task or environment has
radically changed. This suggests that loosely commanded organizations may be more
effective at dealing with complex problems if the increase in threat is accompanied by
radical changes in the environment and a need for innovative responses. Applied to
17 Group Decision Making under Threat: The Tycoon Game, Deborah L. Gladstein; Nora P. Reilly, The Academy of Management Journal, Vol. 28, No. 3. (Sep., 1985): 613. / Threat Rigidity Effects in Organizational Behavior: A Multilevel Analysis, Barry M. Staw, Lance E. Sandelands, Jane E. Dutton, Administrative Science Quarterly, Vol. 26, No. 4 (Dec., 1981). / Organizational Actions in Response to Threats and Opportunities Prithviraj Chattopadhyay; William H. Glick; George P. Huber The Academy of Management Journal, Vol. 44, No. 5. (Oct., 2001).
10
terrorist group structures, the threat-rigidity proposition offers a second hypothesis:
terrorist groups facing external threats will become increasing centralized and tightly
commanded over time.
Popular Support
Literature on popular support for terrorist groups, insurgencies and secret
societies provides some insight into terrorist group counterintelligence. To keep the
scope of this study narrowly focused on the behavior of terrorist groups, the study will
only incorporate insights from insurgencies and secret societies that are widely seen as
terrorist groups.18 The literature has come to a general consensus that secretive armed
groups generally cannot survive without either active or passive support from a
surrounding population.19 A sociological study of violent, underground movements
showed that securing public sympathy and support was often their first task.20 Nathan
Leites and Charles Wolf argue that one of the most important forms of support for a
rebellion is the act of popular nondenunciation, which they define as a population’s
refusal to provide information to the government about a rebel group.21 More active
forms of support include the provision of safe houses and storage facilities and the
18 While a wide range of insurgencies share many common characteristics with terrorist groups there are many important differences between these two classes of armed groups and exploring how these differences impact the core hypotheses is beyond the scope of this study. 19 Cronin, Summer 2006. / Explaining Terrorism: The Contribution of Collective Action Theory Anthony Oberschall, Sociological Theory, Vol. 22, No. 1, Theories of Terrorism: A Symposium. (Mar., 2004): 30. 20 Sociology of Secret Societies Joseph S. Roucek American Journal of Economics and Sociology, Vol. 19, No. 2. (Jan., 1960): 167. 21 Nathan Leites and Charles Wolf, Jr., Rebellion and Authority: An Analytical Essay on Insurgent Conflicts, (The RAND Corporation, Markham Publishing Company, Chicago: 1970): 10.
11
identification of outsiders and counterintelligence threats in the terrorist group’s territory.
For example, the Provisional Irish Republican Army (PIRA) occasionally used local
sympathizers in the government tax offices of Northern Ireland to identify PIRA
members who were earning and spending ‘beyond their means’—an indication that the
member was earning money on the side as a British informant.
Terrorists often garner public support through direct contact with a ‘host’
population. Terrorists may then gain the advantage of living among the host populations,
whereas government forces are quickly identifiable as hostile and external. Thus,
proximity to a supportive host population can reduce a terrorist group’s
counterintelligence vulnerabilities if the population can help the group identify suspected
government agents and intelligence operations. Occasionally a group will gain public
support with more coercive tactics. For example, populations may feel social pressure
not to collaborate with the police or may fear the consequences of being exposed as a
collaborator.
Another way terrorist groups generate public support is to use local and
international media. A study of insurgency and terrorism in Southern Africa showed that
exploitation of the local media featured prominently in strategies for gaining popular
support. 22 Terrorists and insurgents used the local media in two ways. First, they relied
on media coverage of their violent operations to convey messages to the public about
government ineffectiveness. Second, they cultivated long term relationships with media
22 Insurgent Violence versus Image Management: The Struggle for National Images in Southern Africa Jarol B. Manheim; Robert B. Albritton British Journal of Political Science, Vol. 17, No. 2. (Apr., 1987): 202.
12
organizations and journalists in order to influence media output. For these groups,
exploiting and influencing the media paid large dividends—the study found that even in
the context of highly salient historical events, both the government and the terrorist and
insurgent groups succeeded in manipulating images portrayed in the media to their
advantage.23
Studies of terrorist groups and popular support show a similar pattern. In a study
of militant Islamic Palestinian groups, Mia Bloom found that public support for and
recruitment into radical Palestinian groups increased as a direct result of the groups’ use
of high-profile suicide bombings.24 Robert Pape’s analysis of suicide bombing argued
that terrorist groups have successfully employed this method of attack to alter the
adversary government’s policies 25—presumably an element of public sympathy for the
terrorist group or outrage at heavy-handed government tactics played a large role in this
process.26 Interestingly, competition among Palestinian groups led some groups to claim
responsibility for attacks before it became evident whether their members had conducted
the attacks.27
23 Manheim et al., 218. 24 Palestinian Suicide Bombing: Public Support, Market Share, and Outbidding Mia M Bloom. Political Science Quarterly. (New York: Spring 2004. Vol. 119, Iss. 1). 25 Robert A. Pape The Strategic Logic of Suicide Terrorism The American Political Science Review, Vol. 97, No. 3. (Aug., 2003). 26 A contrasting view is presented is Max Abrahms’ “Why Terrorism Does Not Work,” in International Security, Fall 2006. Abrahms argues that terrorist groups rarely achieve their core objectives using terrorism, particularly when targeting civilians. However, Abrahms fails to account for the critical importance of most terrorist groups’ small, daily, bureaucratic successes, especially as they communicate with their constituency as well as the adversary government through their ‘resistance efforts’. 27 The Changing Nature of Suicide Attacks: A Social Network Perspective Ami Pedahzur, Arie Perliger. Social Forces. (Chapel Hill: Jun 2006. Vol. 84, Iss. 4): 1987.
13
While the literature highlights the benefits of popular support to armed
movements, theoretical exploration of the downsides of popular support is almost non-
existent. The central question around this gap in the literature is: in what ways do
terrorist groups jeopardize their survival and operational activities in their selection of
popular support strategies?
Popular Support and Counterintelligence. A brief look at the historical record of
terrorist group behavior suggests that there is a natural tension between gaining
popularity and maintaining secrecy. Terrorist group leaders often devote considerable
time to improving their public image to increase popular support or improve group
morale and cohesion. For example, the leader of Filipino terrorist group Abu Sayyaf
spent substantial time with local media organizations bragging about his battles with
Filipino security forces.28 Underground resistance groups in Czechoslovakia in World
War II relied on illicit radio stations to broadcast their anti-Nazi message. This activity
put the underground groups at considerable risk as Nazi radio direction-finders
occasionally located illicit Czech stations and dealt with offenders harshly.29
In another instance, in 1975 the Greek terrorist group November 17 released a
detailed account of how it assassinated a US official in Greece by taking advantage of the
Greek police’s counterintelligence vulnerabilities.30 Though November 17 released the
account to prove to the Greek public that it was responsible for the operation, Greek
28 Mark Bowden, “Jihadists in Paradise”, Atlantic Monthly, March 2007. 29 Roucek, 167. 30 George Kassimeris, Europe’s Last Red Terrorists: The Revolutionary Organization 17 November (Hurst and Company, London 2001): 234.
14
security forces were provided an opportunity to learn about the terrorist group’s
operational procedures and improve police communications security.
Similarly, many terrorist group leaders tend to relish the media spotlight. Though
developing media support for the group may help to bolster the group’s popularity,
occasionally group leaders bask in the spotlight to develop a personal popularity which
does not directly serve the group. Yassir Arafat, for example, had a huge appetite for
publicity and gave many interviews to Western reporters. While these interviews most
likely resulted in some increase in popular support for Arafat’s terrorist group, they also
provided his adversaries with valuable assessment data on his location and health, in
addition to valuable information about his group.
This leads to our hypotheses about popular support and terrorist groups.
Hypothesis 2(A): A terrorist group with popular support, relative to one without popular
support, will have greater counterintelligence support from the local population.
Hypothesis 2(B): A terrorist group with popular support, relative to one without popular
support, will be more likely to expose sensitive information about its personnel and
operations through its efforts to generate and maintain popular support. The study will
test this hypothesis and probe the deeper question: under what conditions do high-profile
popular support campaigns serve as a net benefit to terrorist groups?
15
Controlled Territory
Controlled territory is a geographical space where a terrorist group regulates
physical access to and security within defined territorial boundaries.31 Controlled
territory can be acquired either from a state sponsor granting a terrorist group freedom of
movement within its borders or from a weak government that does not have the resources
or the will to challenge the terrorist group’s control of the territory.
The literature on terrorist group use of controlled territory is thin and the
counterinsurgency literature has addressed this issue to only a limited extent.32 The
creation of an insurgent ‘state’ can be characterized as developing in three stages.33 In
the first stage, the terrorist or insurgent group has no fixed territorial base and relies on
mobile warfare. In the second stage, the group establishes a core territory and begins to
engage in terrorist and guerrilla warfare and more open confrontations with the adversary
state. In the third stage, the group controls a large swath of territory and defends the
territory with more conventional military strategies. A study of the Shining Path
organization in Peru revealed that the group developed a large network of sympathizers
in the first phase and later converted that sympathy into a core territorial base. In the
31 Though the literature on insurgencies is discussed in this section, the study limits the analysis of this literature to insights relevant to how terrorist groups acquire and use controlled territory. 32 African Militaries and Rebellion: The Political Economy of Threat and Combat Effectiveness, Jeffrey Herbst, Journal of Peace Research, Vol. 41, No. 3. (May, 2004). 33 Geographical Dimensions of the Shining Path Insurgency in Peru Robert B. Kent Geographical Review, Vol. 83, No. 4. (Oct., 1993): 441.
16
final stage, Shining Path controlled access to its territorial base so effectively that it was
able to evict non-sympathizers from key areas.34
Controlling territory is intimately linked to popular support. It is unlikely that a
terrorist or insurgent group could control territory for an extended period without the
direct or indirect support from the resident population. In some cases, terrorist groups
may lose popular support if they poorly manage key controlled territories. The Shining
Path suffered from a decline in popular support when its economic and social policies
were disagreeable to the population within Shining Path territory. Studies of inner city
gangs show that gangs typically maintain control of urban turf and popular sympathy
around this turf as long as their operations do not disrupt the normal day-to-day activities
of the local population.35 The struggle to maintain popular support in a controlled region,
and the challenges this poses to terrorist group counterintelligence, is a key theme of the
study.
Controlled Territory and Counterintelligence. Access to controlled territory may
provide a terrorist group many counterintelligence advantages. Territory allows the
group to train, communicate, and meet face-to-face with other group members with a
degree of freedom not available in hostile, uncontrolled territory. For example, in the
1970s the Palestinian terrorist group Fatah protected the secrecy of its communications
and operational plans far more effectively in its controlled territory in Beirut than in the
34 Kent, 442. 35 Residence and Territoriality in Chicano Gangs Joan Moore; Diego Vigil; Robert Garcia Social Problems, Vol. 31, No. 2. (Dec., 1983): 184. / Community Tolerance of Gang Violence Ruth Horowitz Social Problems, Vol. 34, No. 5. (Dec., 1987): 437.
17
uncontrolled territory of the West Bank, which was deluged with Israeli security agents
and collaborators.
On the other hand, controlled territory can confine a group and give the adversary
a ‘target’ territory to monitor and against which it can array its forces. Thus, a terrorist
group may enjoy greater secrecy within a controlled territory but the terrorist group’s
movements into and out of their controlled territory will be easier for the adversary to
track. For example, a state adversary with territory adjacent to that of a terrorist group
can set up checkpoints on their common ‘border’ to monitor movement in and out of the
area with technical or human assets. Individuals of interest can then be followed into the
state adversary’s territory to identify contacts and activities. A terrorist group that
controls territory is also under greater pressure to maintain popular support—particularly
if it wishes to deter adversary collaborators from developing and thriving within its
territory.
These insights lead to the controlled territory hypotheses. Hypothesis 3(A): A
terrorist group with controlled territory, relative to one without territory, will have
superior communications security, physical security and counterintelligence vetting.
Hypothesis 3(B): A terrorist group with controlled territory, relative to one without
territory, will be more vulnerable to its adversary’s efforts to track the group’s gross
financial, logistical and personnel movements into and out of the controlled territory.
Because popular support and controlled territory would appear to be highly correlated,
testing this hypothesis will require a close examination of, and control for, the effects of
popular support.
18
Control Variable: The Adversary’s Counterterrorism Capabilities
The adversary’s counterterrorism capability is an important control variable in
this study. Controlling for this variable will be crucial for demonstrating that a terrorist
group’s counterintelligence strengths and vulnerabilities are a result of changes in
organizational structure, popular support and controlled territory rather than changes in
the strength of the adversary.
Terrorist groups face a wide variety of adversaries, which differ significantly in
their counterterrorism capabilities. A state adversary with strong counterterrorism
capabilities will employ a counterterrorism strategy that involves diligent police work,
rather than heavy-handed military tactics, good coordination between police and
intelligence agencies, and the prudence to avoid costly overreactions to terrorist
activities. A state adversary that does not perform diligent police work, foster
coordination between police and intelligence agencies nor avoid costly overreactions may
permit its terrorist adversary to evade capture and capitalize on a windfall of popular
support.
The terrorist group and its state adversary are often engaged in a competitive and
dynamic relationship. A move or innovation by a terrorist group will frequently result in
a countermove or counter-innovation by the state adversary, and vice versa. Because the
state typically outmatches its terrorist adversary in military strength, the terrorist group
will struggle to stay hidden and operate clandestinely by constantly improving its
counterintelligence practices. For example, the Indonesian terrorist group Jemaah
19
Islamiyya adopted sophisticated communications encryption standards in the 1990s as a
result of Indonesian law enforcement efforts to intercept the group’s communications.36
A terrorist group that does not adapt to its adversary’s intelligence gathering
innovations will quickly be defeated. Bruce Hoffman describes the process as one of
“natural selection…whereby every new terrorist generation learns from its predecessors,
becoming smarter, tougher, and more difficult to capture or eliminate.”
Innovation and counter-innovation doesn’t always lead to more technologically
sophisticated strategies. In many cases terrorist groups will strengthen their
counterintelligence by adopting more ‘primitive’ or basic counterintelligence practices.
Groups may avoid higher technologies and rely instead on more basic or archaic ways of
communicating with its members and vetting its personnel.
Control Variable: Resources and State Sponsorship
Understanding a terrorist group’s financial and personnel resources will be critical
for this study as well. Controlling for the resources variable will help to demonstrate that
a terrorist group’s counterintelligence strengths and vulnerabilities are a result of changes
in organizational structure, popular support and controlled territory rather than changes in
the group’s overall resources.
State sponsorship is an important component of the resources variable. States
support terrorist groups for a variety of reasons and in a variety of ways. This variation
affects how terrorist group counterintelligence is impacted by state support. Dan Byman
identifies eight reasons why states sponsor terrorist groups: to weaken and destabilize a
36 Larry Margasak, “Philippines reports show terrorists' careful plans,” The Associated Press, April 7, 2003.
20
neighbor, to project power, to change a neighboring regime, to shape the opposition of a
neighboring regime, to increase international prestige, to export a political system, to aid
their kin, and to provide a terrorist group with a military boost.37 States also vary the
type and level of support they provide to terrorist groups. Byman categorizes state
sponsorship into six levels: a strong supporter is highly committed to the terrorist group
and offers significant resources, a weak supporter is highly committed to the terrorist
group but does not have significant resources to offer, a lukewarm supporter favors the
terrorist group but provides a terrorist group with only indirect support, an antagonistic
supporter favors the terrorist group but seeks to control it or weaken its cause, and a
passive supporter does not directly aid a terrorist group but knowingly turns a blind eye
to the group’s activities.38 A state’s motivation for supporting a terrorist group will shape
the type of counterintelligence and intelligence support a group receives from the state.
Ultimately, state sponsorship is a double-edged sword. On the one hand, a strong
supporter can enhance a group’s capabilities directly by training the terrorist group in
counterintelligence methods and sharing state-collected intelligence or indirectly by
providing the group with safehaven and logistical counterintelligence assistance. On the
other hand, an antagonistic supporter can heighten a terrorist group’s exposure by
compromising information about the group in order to manipulate and control it.
37 Daniel Byman, Deadly Connection: States that Sponsor Terrorism, (Cambridge University Press, 2005): 36 -50. 38 Byman, 2005, 15.
21
Additional Insights from the Literature: Secret Societies
The literature on secret societies offers additional insight into the core variables.
A secret society is defined as a group that holds as one of its primary organizational
objectives to keep its personnel, plans, and processes hidden from non-group members.
Using this definition, terrorist groups can be classified as a type of secret society—though
terrorist groups have many objectives, keeping personnel, plans and processes secret
from the adversary are a primary goal.
The literature on secret societies helps us to explore the interaction between
organizational structure and secrecy in terrorist groups. Sociologist Georg Simmel
originally posited that secret societies are rational, deliberate, and hierarchical. More
recent work on secret societies shows that their structures vary widely. 39 Bonnie
Erickson argues that a secret organization’s structure reflects the structure of the social
networks the group taps into to recruit new members. 40 As secret organizations enhance
security by recruiting from trusted social, clan, family and neighborhood networks,
groups will trend towards less hierarchy because new recruits will have many
connections to existing group members at all levels of the organization.41 The
proliferation of informal connections between many levels of the organization would
naturally lead to an erosion of hierarchy and chain of command. This insight conflicts
with the threat-rigidity hypothesis, which posits that terrorist groups facing external
threats will become increasing centralized and tightly commanded over time. Erickson’s
39 Bonnie H. Erickson, “Secret Societies and Social Structure”, Social Forces, Vol. 60, No. 1. (Sep., 1981): 195. 40 Erickson, 195. 41 Erickson, 196.
22
insights suggest that an increase in external threats may lead to less hierarchy and
centralization in terrorist groups as recruitment from only the most trusted social, clan
and family networks increases.
A second insight from secret society literature offers further support to this
hypothesis. A secret organization should prioritize keeping its plans, leaders, and core
personnel hidden from its adversaries. Adopting an organizational structure most
conducive to maintaining secrecy should then be a goal of any secret group. Though a
variety of organizational designs offer secrecy advantages, a decentralization of
command would seem the ideal structure for maximizing concealment. Decentralization
reduces the number of connections and regular interactions between group members—
and particularly between core leaders and lower level members—which in turn reduces
the chances that group members implicated in crimes would be directly linked to other
members. A study of illegal networks showed that centralized networks had more
vulnerabilities at their core as the large volume of connections between key leaders
allowed them to be more easily identified by law enforcement than lower-level
members.42 Thus, according to this scholarship, a secret organization under threat will be
expected to adopt a more decentralized organizational model. Lending support to this
hypothesis, Ronfeldt and Arquilla argue the less hierarchical, more ‘networked’ forms of
organization are better suited for survival, and are increasingly common, in the
42 The Social Organization of Conspiracy: Illegal Networks in the Heavy Electrical Equipment Industry Wayne E. Baker; Robert R. Faulkner American Sociological Review, Vol. 58, No. 6. (Dec., 1993): 844.
23
globalization age.43 The study will test these hypotheses by observing how the structures
of several terrorist groups over time change and whether these changes produce net
beneficial effects.
Secret societies develop numerous methods for keeping themselves hidden,
including limiting face-to-face contact between members, concealing leaders, and
minimizing channels of communication. Many groups invent special coded language and
decision rules to substitute for direct, personal communication.44 Using coded language
can turn into a vulnerability, however, if the adversary cracks the code. Groups
occasionally insulate key leaders from ‘partially’ initiated members at the group’s
periphery.45 This can also become a vulnerability if the partially initiated are less
indoctrinated and therefore easier for the adversary to recruit and turn against the group.
Additionally, insulating leaders renders oversight of decision-making on intelligence
matters nearly impossible and this reduction of oversight almost certainly reduces the
quality of intelligence analysis for the entire group.46 Exploring the tradeoffs that come
with adopting security strategies, such as these, is a key focus of the study.
43 David Ronfeldt and John Arquilla, Networks and Netwars: The Future of Terror, Crime and Militancy, (The Rand Corporation): 311. 44 Peasant Politics and Secret Societies: The Discourse of Secrecy Robert C. Ulin Anthropological Quarterly, Vol. 59, No. 1. (Jan., 1986): 36. 45 A Test of Simmel on the Secret Society: The Doukhobors of British Columbia H. B. Hawthorn The American Journal of Sociology, Vol. 62, No. 1. (Jul., 1956): 7. 46 Ritchie P. Lowry, “Toward a Sociology of Secrecy and Security Systems,” Social Problems, Vol. 19, No. 4. (Spring, 1972): 446.
24
Additional Insights from the Literature: Misconduct in Organizations
The literature on misconduct in organizations also offers insight into the core
variables and their effects on terrorist group counterintelligence.47 Every secret
organization with an adversary must actively prevent its members from defecting and
becoming informants for the adversary. The literature on misconduct and betrayal in
organizations suggests that particular features of the organization and its environment can
increase or decrease the likelihood that an organization’s members will engage in
betrayal. This section highlights the organizational and environmental features that are
most relevant to terrorist group counterintelligence.
Betrayal in secret organizations can be divided into at least three categories: the
informant, the unwitting informant, and the agent provocateur.48 The informant is a
trusted insider in a secret organization who reports to the adversary on the secret
personnel, plans and strategies of his organization. The unwitting informant is a trusted
insider whose careless or injudicious actions may inadvertently allow the adversary to
collect sensitive information about the secret organization. The agent provocateur is a
trusted insider, controlled by the adversary, who covertly leads his secret organization in
a direction desirable to the adversary. The agent provocateur is a rare form of betrayal in
terrorist organizations due to the difficultly of penetrating a terrorist group at a leadership
level. The agent provocateur is a more valuable penetration, however, because it allows
47 Specifically the literatures explored are those on trust in organizations, informants and agent provocateurs, defectors and whistle-blowers, white-collar crime and insider trading, and the free-rider problem in collective action scenarios. 48 Steven Greer, “Towards a Sociological Model of the Police Informant,” The British Journal of Sociology, Vol. 46, No. 3. (Sep., 1995): 513.
25
the adversary to monitor the terrorist group as well as control some of its behaviors,
potentially hastening the group’s demise.
Individuals may betray their secret organization for a number of reasons.49 An
individual may be coerced, promised lenient punishment, or offered financial rewards by
a powerful adversary. An individual may also invite contact with the adversary in order
to change the direction of his organization, retaliate for being marginalized within the
organization, resolve a personal vendetta, or enhance his sense of importance and self-
esteem.
The unwitting informant does not actively betray his organization but may, by his
careless actions, provide more information to the adversary than a witting informant. The
literature on the free-rider problem in collective action scenarios offers an interesting
window into counterintelligence lapses regarding unwitting informants. Free riding is the
tendency for individuals to avoid contributing to group efforts to obtain a collective good
when the costs of participating in those efforts outweigh the benefits of obtaining the
good. The free rider problem occurs because (1) an individual’s participation in large
group efforts will not have a discernable impact on the provision of the good and (2) if
the good is provided, every individual will enjoy its provision without necessarily having
borne the costs of obtaining it.50
49 Gary T. Marx, “Thoughts on a Neglected Category of Social Movement Participant: The Agent Provocateur and the Informant,” The American Journal of Sociology, Vol. 80, No. 2. (Sep., 1974): 414. 50 Will H. Moore, “Rational Rebels: Overcoming the Free-Rider Problem,” Political Research Quarterly, Vol. 48, No. 2. (Jun., 1995): 424. / To Snitch or Not to Snitch? Applying the Concept of Neutralization Techniques to the Enforcement of Occupational Misconduct, Jana L. Pershing, Sociological Perspectives, Vol. 46, No. 2. (Summer,
26
In this context, secrecy can be thought of as a collective good. Everyone in a
secret organization benefits from enhanced secrecy, as the adversary will be less able to
locate, monitor and dismantle the organization. The organization’s ability to acquire this
collective good is enhanced when all group members forsake the particular desires and
comforts that erode collective secrecy. Such comforts include, visiting or conversing
with family and friends, using modern technologies, developing friendships outside the
organization, publicly claiming affiliation with the organization, bragging to family and
friends about secret activities and, in some ways, living a ‘normal’ open life. While none
of these behaviors necessarily furnishes the adversary with sensitive information, a clever
adversary may collect this information covertly. Furthermore, none of the above actions
may offer the adversary a complete picture of a secret organization’s processes and plans,
but collected over time, these bits of information can be assembled to create a nearly
complete picture of an organization.
Importantly, there are organizational and environmental features that can alleviate
the free rider problem. Increasing a group member’s sense of efficacy—the idea that his
behavior can impact the organization significantly—is one method for reducing the free
rider problem. Establishing conventions and contracts against engaging in compromising
behavior is another way to reduce free riding. This method relies on strong peer pressure
to deter group members from being tempted to avail themselves of compromising
comforts. Monitoring group members closely is another method for reducing free riding.
2003): 153. / Wendy L. Hansen; Neil J. Mitchell; Jeffrey M. Drope, “The Logic of Private and Collective Action,” American Journal of Political Science, Vol. 49, No. 1. (Jan., 2005).
27
This technique reduces the anonymity of anti-group behavior and promises punishment
for such behavior.
Misconduct and Counterintelligence.51 Whether a group has controlled territory
can potentially affect the extent to which groups grapple with the counterintelligence free
rider problem. 52 Studies of civil conflict and rebellion propose that geographical
dispersion of a rebel group results in higher rates of defection and betrayal. Higher rates
of defection, it is posited, result from the core leaders’ diminished ability to detect and
punish transgressions.53 Conversely, reduced defection is linked to the group’s ability to
compensate rebels with the spoils of war—a task made more difficult with geographical
dispersion.54
The popular perception of terrorist groups is that they are composed of fiercely
dedicated operatives, who are unlikely to defect and do not need to be compensated for
their dedication. Are terrorist groups subject to the same defection and betrayal
difficulties that seem to plague rebel and insurgent groups with regards to geographical
dispersion? The controlled territory hypothesis posits that terrorist groups that control
territory will have superior counterintelligence, which is supported by the notions
51 Terrorist groups that do not control territory are assumed to be more geographical dispersed than groups that do control territory. 52 Insight into the impact of complexity and formalization on misconduct are explored in: Nancy Reichman, “Breaking Confidences: Organizational Influences on Insider Trading,” The Sociological Quarterly, Vol. 30, No. 2. (Summer, 1989): 187. / Diane Vaughan, “The Dark Side of Organizations: Mistake, Misconduct, and Disaster,” Annual Review of Sociology, Vol. 25. (1999): 277. 53 Scott Gates, “Recruitment and Allegiance: The Microfoundations of Rebellion,” The Journal of Conflict Resolution, Vol. 46, No. 1, Understanding Civil War. (Feb., 2002): 117. 54 Patrick M Regan, Daniel Norton, “Greed, Grievance, and Mobilization in Civil Wars,” The Journal of Conflict Resolution, (Beverly Hills: Jun 2005. Vol. 49, Iss. 3): 319.
28
introduced above. The case studies will explore the relationship between territory and
counterintelligence in detail, and perhaps illuminate whether defection and betrayal
increase with geographical dispersion.
Section Three: Hypotheses
This section restates the hypotheses to be tested against case studies of five
terrorist groups: al Qaeda, the Provisional Irish republican Army (PIRA), the Egyptian
Islamic Group (IG), the Palestinian nationalist group Fatah and, its offshoot, the Black
September Organization (BSO), as well as against a lower resolution assessment of
thirty-three terrorist groups.
Hypothesis 1(A): A terrorist group with a tight command and control structure,
relative to a group with a loose command structure, will have superior counterintelligence
training and compartmentation.
Hypothesis 1(B): A terrorist group with a tight command and control structure,
relative to a group with a loose command structure, will be more vulnerable to its
adversary’s efforts to develop high-level penetrations and exploit the group’s
standardized counterintelligence procedures. Thus a tight command structure will make
the recruitment of high-level penetrations more difficult, but more damaging if they are
acquired.
Hypothesis 2(A): A terrorist group with popular support, relative to one without
popular support, will have greater counterintelligence support from the local population.
Hypothesis 2(B): A terrorist group with popular support, relative to one without
popular support, will be more likely to expose itself in its efforts to maintain popular
29
support. Specifically, a campaign to maintain popular support often requires that a
terrorist group raise its operational profile to make contact with independent media
organizations and inspire its supporters with details about the group’s leaders,
organization and terrorist plans.
Hypothesis 3(A): A terrorist group with controlled territory, relative to one
without territory, will have superior communications security, physical security and
counterintelligence vetting.
Hypothesis 3(B): A terrorist group with controlled territory, relative to one
without territory, will be more vulnerable to its adversary’s efforts to track the group’s
gross financial, logistical and personnel movements.
Hypothesis Four: Terrorist groups facing external threats will become increasing
centralized and tightly commanded over time.
Section Four: Control Variables
Our core hypotheses test how three key independent variables affect the
dependent counterintelligence variables. However, there are several other variables that,
if not properly controlled for, could influence the outcome of dependent variables. These
variables are called control variables because they will be held constant over time to
strengthen our confidence in the hypothesized effects of independent variables.
The study does not test the control variables as it does the independent
variables—that is, there are no hypothesized ‘effects’ on terrorist group
counterintelligence associated with shifts in the adversary’s capabilities, terrorist group
resources, or organizational learning. The effects of the independent variables on
30
terrorist group counterintelligence are somewhat surprising and counterintuitive, but the
potential effects of control variables seemed more obvious and less interesting. Thus,
while a terrorist group’s adversary and its resources may be a good predictor of its overall
counterintelligence capabilities, understanding the group’s organizational structure,
popular support and controlled territory potentially offers insights into more subtle and
less often exploited vulnerabilities. The key control variables are: the adversary’s
counterterrorism capabilities, terrorist group resources, and terrorist group learning.
Adversary Capabilities. Appreciating changes in the adversary’s counterterrorism
capabilities is perhaps the most important control variable. For Hypothesis 1, a tightly
commanded group is expected to be less vulnerable to low-level penetrations but more
vulnerable to high-level penetrations. If we observe this phenomenon as terrorist group
structure changes, we need to ensure that this variation is not due to the adversary’s
increasing adeptness at developing high-level penetrations. Perhaps the adversary’s
increased capability is leading directly to the development of high-level penetrations as
well as forcing the terrorist group’s structure to centralize.
For Hypothesis 2(B), a group generating popular support is expected to induce
counterintelligence vulnerabilities. If we observe this phenomenon, we need to ensure
that this variation is the result of the group’s campaigns to increase popular support,
rather than the adversary’s decreased ability to collect information about the group—this
would be a case where the group understood that it was increasing its counterintelligence
vulnerabilities knowing that the weakened adversary would be unable to capitalize on
31
them. Perhaps the adversary has become weaker, allowing the group to become bolder in
its publicity campaign while capitalizing on increased support.
For Hypothesis 3(A), a group not controlling territory is expected to have inferior
communications security and physical security. If we observe this phenomenon as
terrorist group territory changes, we need to ensure that this variation is not due to the
adversary’s increasing ability to locate and attack the group. Perhaps the group
abandoned its territory, or never sought territory in the first place, because the adversary
became too strong. Understanding the terrorist group’s motive for operating outside of
controlled territory will be important for judging this alternative hypothesis.
Resources. Resources are almost certainly a primary determinant of intelligence
and counterintelligence capability. A group with more money will be able to buy more
sophisticated technology, bribe and recruit more adversary informants, motivate and
retain top group leaders and operatives with a generous salary, and engineer sophisticated
campaigns to generate popular support. Financial resources are highly correlated with
capabilities, and therefore they are very important to control for and measure.
For Hypothesis 1(A), a tightly commanded group is expected to enjoy superior
counterintelligence training and compartmentation. If we observe this phenomenon as
terrorist group structure changes, we need to ensure that this variation is not due to the
group’s increased resources. Perhaps the group’s increased resources allowed it to
centralize its command structure, inspire the allegiance of a larger portion of the group,
and mandate training for group members.
32
For Hypothesis 3(A), a group controlling territory is expected to have superior
communications security and physical security. If we observe this phenomenon as
terrorist group territory changes, we need to ensure that this variation is not due to the
group’s overall increase in resources. Perhaps the group’s ability to gain controlled
territory and implement improved communications security both result from having
greater financial resources.
Organizational Learning. Organizational learning can be defined as a process
through which a group acquires new knowledge of technology that it then uses to make
better strategic decisions, improve its ability to develop and apply specific tactics and
increase its chances of success in its operations.55 For this study it will be important to
demonstrate that variations in terrorist group counterintelligence that can be considered
improvements are related to changes in the core variables rather than solely as a result of
the group’s acquisition of new knowledge.56
For Hypothesis 1(A), if changes in structure lead to superior counterintelligence
training and compartmentation, we need to ensure that this improvement is not the result
of increased learning capacity that leads to general improvements across a broad
spectrum of activities. For example, perhaps the group has learned that a centralized
command structure is superior in addition to learning how to better implement
counterintelligence training and compartmentation.
55 Brian Jackson, et al, “Aptitude for Destruction Volume 1: Organizational Learning in Terrorist Groups and its Implications for Combating Terrorism.” RAND (2005). 56 Of course, this distinction does not apply if the new knowledge leads the group to change one of more of the core variables, such as whether the group is more hierarchical or territory-seeking.
33
For Hypothesis 2(A), a group generating popular support is expected to enjoy
more counterintelligence support from the local population. If we observe this
phenomenon, we need to ensure that this variation is the result of wider spread popular
support, rather than the group’s ability to squeeze additional support from the same
subset of the population.
For Hypothesis 3(A), a group controlling territory is expected to have superior
communications security and physical security. If we observe this phenomenon, we need
to ensure that this variation is not the result of the group’s learned ability to both acquire
territory and improve security measures.
It will be difficult, and perhaps not always necessary, to completely separate
improvements in counterintelligence from normal organizational learning. In fact, most
intentional changes in strategy that lead to improvements will be considered
organizational learning by definition. Thus, what the study will demonstrate is that when
normal learning does occur the counterintelligence improvement would have not
occurred, or the learning would not have been possible, without the core variable change.
The study will have to demonstrate that the core variable change played the primary role
in the improvement and that the improvement was not purely the result of organizational
learning.
One additional way of controlling for organizational learning is to select cases
where the change in the core variable predicates the opposite outcome of the
organizational learning hypothesis. The cases for this study occasionally offer the
opportunity to control for learning in this manner.
34
Sample of Core Hypotheses and Alternative Explanations Core Hypothesis Control Variable Explanation
Organizational Structure
As structure tightens, training and coordination improve
1) Adversary is getting weaker. 2) Terrorist group resources are increasing. 3) Terrorist group is experiencing normal learning over time.
Popular Support
As support increases, vulnerabilities increase with media exposure
1) Adversary is getting stronger.
Controlled Territory
With territory, security and vetting improve
1) Adversary is getting weaker. 2) Terrorist group resources are increasing. 3) Terrorist group is experiencing normal learning over time.
Section Five: Alternative Hypotheses
Throughout the study, we will consider a number of alternative hypotheses to
explain terrorist group behavior. The alternative hypotheses contradict the core
hypotheses, stating that there are no relationship between the independent and dependent
variables.
Alternative Hypothesis 1(A): A terrorist group with a tight command and control
structure will not have superior counterintelligence training and compartmentation. Tight
command structures may have little impact on a group’s propensity or ability to adopt
more sophisticated training and compartmentation.
Alternative Hypothesis 1(B): A terrorist group with a tight command and control
structure will not be more vulnerable to its adversary’s efforts to develop high-level
penetrations and exploit the group’s standardized counterintelligence procedures.
Penetrations of terrorist groups may be so difficult for an adversary that the group’s
35
organizational structure has little impact on this outcome. Standardized
counterintelligence procedures may also not present a discernable vulnerability relative to
non-standardized counterintelligence procedures.
Alternative Hypothesis 2(A): A terrorist group with popular support will not have
greater counterintelligence support from the local population. Local populations may
have little to offer terrorist groups in the way of counterintelligence support, regardless of
their attitude towards the terrorist group.
Alternative Hypothesis 2(B): A terrorist group with popular support will not be
more likely to expose itself in its efforts to maintain popular support. While a terrorist
group’s popular support campaign may provide the adversary with information about the
group, none of this information may be sensitive or actionable from the adversary’s
perspective.
Alternative Hypothesis 3(A): A terrorist group with controlled territory will not
have superior communications security, physical security and counterintelligence vetting.
Whether a terrorist group controls territory may not have a significant impact on its
ability to secure its communications and personnel.
Alternative Hypothesis 3(B): A terrorist group with controlled territory will not be
more vulnerable to its adversary’s efforts to track the group’s gross financial, logistical
and personnel movements. A terrorist group’s adversary will undoubtedly have
significant trouble tracking the terrorist group’s movement, and whether the group
controls territory may have little impact on this difficult task.
36
Alternative Hypothesis 4: Terrorist groups facing external threats will not
become increasing centralized and tightly commanded over time. As discussed earlier, a
terrorist group’s need for secrecy may push it to loosen rather than tighten as it faces
external threats.
Section Six: Variable Measurement
Measuring the dependent variables will present some challenges. In some cases,
making an absolute judgment on dependent variable values will be straightforward, but in
some cases variable values will exist in a gray, middle ground where precise
measurement is more difficult. In the latter cases, measuring each dependent variable’s
relative change over time will help to isolate the effects of its shift on the independent
variables. For example, if a terrorist group shifts from being rigidly ‘tightly controlled’
to significantly less ‘tightly controlled’, the independent variables should reflect the
hypothesized affects of a loosening command structure.
For organizational structure in general, organizations in which leaders exercise
strategic, operational and tactical control over their personnel will be considered tightly
commanded. The challenge of measuring organizational structure is interpreting the
extent of leaders’ strategic, operational, and tactical control from the behavior of the
group’s lowest level members. In some cases it will be obvious that leaders do or do not
control subordinates, and in other cases this will require greater investigation of how
subordinate behavior is in accord with top leaders’ strategic directions.
Groups with widespread sympathy and popularity among large segments of the
population, relative to their adversary, will be defined as possessing high levels of
37
popular support. In some cases, whether a terrorist group enjoys widespread support will
be obvious. In cases where the terrorist group has some popular sympathy, but not
overwhelming popularity, this variable will be more challenging to measure.
Groups that regulate physical access to and security within a defined, and
significant, territorial boundary will be defined as possessing controlled territory.
Measuring whether a group has controlled territory will be challenging for groups that
may regulate access to a handful of neighborhoods, though not a significant swath of
territory. Noting shifts in a group’s controlled territory over time will help to make
measurement of this variable more accurate.
State adversaries will be judged as ‘strong’ when they employ a counterterrorism
strategy that involves diligent police work, rather than heavy-handed military tactics,
good coordination between police and intelligence agencies, and the prudence to avoid
costly overreactions to terrorist activities.
Section Seven: From Practice to Theory
The central hypotheses of this study are derived in large part from the various
literatures described above. The case studies to follow will test the hypotheses and also
provide insight into the broader theoretical literatures from which they were derived. The
case studies also weigh in on theoretical debates: Do organizations under threat tend
toward centralization or decentralization? Do geographical dispersion and formalized
monitoring procedures actually exacerbate the free rider problem in secret organizations,
and terrorist groups in particular?
38
The case studies will also fill gaps in the literature: do insights from
organizational theory on centralization and innovation apply to clandestine organizations
and terrorist groups in particular? Does popular support ever produce disadvantages for
terrorist and insurgent groups? The study addresses some of these debates and gaps
immediately with a low-resolution look at thirty-three terrorist group cases. The
following section introduces the counterintelligence typology with which we will classify
our cases and test our hypotheses.
Section Eight: A Counterintelligence Typology
The counterintelligence typology allows us to situate each terrorist group in one
of sixteen possible counterintelligence environments.57 The typological approach offers
at least two benefits. First, the typology allows us to make predictions about and assess
the interactive effects of our three core, dependent variables. For example, glance at the
typology reveals that terrorist groups with a tight command structure, high popular
support, controlled territory and a strong adversary are expected to exhibit the most
sophisticated counterintelligence capabilities, relative to all other possible types. Second,
the typology allows us to isolate changes in one variable while other variables are held
constant. This technique will provide ‘clean’ tests of our hypotheses, assuming we
account for all relevant control variables. Clean tests give us confidence that the
observed effects on terrorist group counterintelligence capabilities—our independent
variables—are caused directly by the observed change in the dependent variable.
57 A typology is a method of classifying of a group of items based on their characteristics.
39
The chart below shows the relationship between the dependent variables and six
independent variables that feature prominently in the hypotheses. The six independent
variables are ‘Standardized CI Training for All Members’ – ST - (Hypotheses 1 and 4),
‘Uniform CI Methods Across the Organization’ - UM - (Hypotheses 1 and 4), ‘CI
Support from Local Population’ – LS - (Hypothesis 2), ‘Damaging CI Exposure Through
Media Contact’ – ME - (Hypothesis 2), ‘Adoption of Communications Security’ – CS -
(Hypothesis 3), and ‘Vetting and Counterespionage Investigation’ –VC - (Hypothesis 3).
The interactive effects on the chart are considered additive, with each independent
variable contributing a +, -, or = based on its unique predicted effects on the dependent
variables. Based the hypotheses, a tight organizational structure adds a plus to ST, UM,
CS and VC and a loose organizational structure contributes a minus. High popular
support adds a plus to LS and ME, and low popular support adds a minus. Controlling
territory adds a plus to ST, CS, and VC and not controlling territory the opposite.
Finally, having a strong adversary, and hence a strong external threat to survival,
contributes a plus to ST and UM.58 The left-hand column shows the sixteen
counterintelligence environment ‘types.’ The values of the six independent variables, on
the right-hand side of the chart, reflect the hypothesized likelihood of observing these
variables with the counterintelligence type.
58 This reflects the predictions of hypothesis four, rather than specific predictions about the effects of the adversary’s capabilities.
40
Variables and Hypothesized Effects
Independent Variables Dependent Variables Type OS PS CT AD ST UM LS ME CS VC
1 + - - - = + - - = = 2 + - - + + + - - + + 3 + - + - + + - - + + 4 + - + + + + - - + + 5 + + - - + + + + = = 6 + + - + + + + + + + 7 + + + - + + + + + + 8 + + + + + + + + + + 9 - - - - - - - - - - 10 - - - + - = - - - - 11 - - + - = - - - = = 12 - - + + + = - - + + 13 - + - - - - + + - - 14 - + - + - = + + - - 15 - + + - = - + + + + 16 - + + +
+ = + + + +
Independent and Control Variables
Inputs
+ Tight OS Organizational Structure - Loose
+ High PS Popular Support - Low
+ Yes CT Controlled Territory - No
+ High AD Adversary Capability - Low
Dependent Variables ST Standardized CI Training for All Members
UM Uniform CI Methods Across the Organization
LS CI Support from Local Population
ME Damaging CI Exposure Through Media Contact
CS Sophisticated Communications Security VC Vetting and Counterespionage Investigation
Hypothesized Outcomes = No Effect - Less Likely + More Likely
41
Section Nine: The Framework Applied to Several Cases The chart below shows thirty-three cases, bounded by year, evaluated on
counterintelligence environment variables and the six independent variables.59 The
thirty-three cases reflect a wide range of terrorist group spanning a variety of
geographical regions, ideologies, time periods and sizes. The data set includes many
‘mature’ terrorist groups—groups that survived for a few years and achieved some
operational success. The sample also includes ‘immature’ terrorist groups—groups that
did not survive long or faced dramatic failure. This helps to balance the cases between
groups enjoying relative success and those suffering relative failure. Despite the
inclusion of several ‘failed’, immature groups, the sample remains biased towards mature
terrorist groups that were sophisticated enough to be around for at least a couple of years,
receive high level attention from the international media and their state adversary. This is
due to the difficulty of finding examples of groups that both experienced immediate
failure and were observed carefully and closely enough to assess the group on the
dependent variables. To further balance on this bias the sample includes several
‘successful’ groups that experienced dramatic failures or setbacks at some point in their
existence, such as Egyptian Islamic Group (1994 – 1995), Al Qaeda (2001-2003), Abu
59 Chart Sources: Jane’s Terrorism and Insurgency Database, Patrick Seale, “Abu Nidal: A Gun For Hire,” Random House, New York, 1992, Robert Meade, Jr. “Red Brigades: The Story of Italian Terrorism,” MacMillan: London, 1990, Neamatollah Nojumi “The Rise of the Taliban in Afghanistan,” Palgrave: New York, 2002, George Kassimeris, “Europe’s Last Red Terrorists: The Revolutionary Organization 17 November” Hurst and Company, London 2001, Anthony Vinci, “The Problems of Mobilization in the Analysis of Armed Groups,” Parameters, Spring 2006, and Robert Clark “The Basque Insurgents: ETA 1952-1980” University of Wisconsin Press, Madison, 1984, Paddy Woodworth, “Dirty War, Clean Hands: ETA, the GAL and Spanish Democracy,” Cork University Press, Cork Ireland, 2001, Gabriela Tarazona_Sevillano, “Sendero Luminoso and the Threat of Narcoterrorism” CSIS, Washington Papers, Praeger: New York, 1990, and various print media. accounts.
42
Sayyaf (1993 – 2001), BSO (1971-1984), and PIRA (1972-1976). Despite these
adjustments, an unavoidable bias towards mature groups remains. However, the sample
remains useful for gaining insight into the strengths and weaknesses of mature terrorist
groups—a task that is particularly relevant from a policy standpoint.
Dependent Variables Groups Type OS PS CT AD ST UM LS ME CS VC
Italian Red Brigades (72-85) 1 + - - - ? ? - - ? + Fatah (1964-1967) 2 + - - + + = - - = + GSPC (1999 -2003) 2 +/- - - + ? ? ? + = ? Zviadists ( 1996 – 1998) 2 + - - + - ? - + ? ? Abu Nidal (1985-1995) 3 + - + +/- + + ? ? ? + LRA ( 2000 – 2004) 4 + - + + + ? - - ? ? AQ (1996-2001) 4 + - + + + + - + + + November 17 (1980–2000) 5 + + - - ? ? - + ? + Orange Volunteers (1999) 6 + + - + + + ? + ? ? BSO (1971-1984) 6 + + - + = = + = + + Abu Sayyaf (1993 – 2001) 7 +/- + + - ? ? + + + + LTTE ( 1999 – 2001) 7 + + + - + + + + + + Taliban ( 1990 – 1996) 7 + + + - + ? ? ? - + Jemaah Islamiyyah (95-01) 8 +/- + + + + + ? ? + + Lashkar-e-Tayyiba (00-04) 8 + + + + + ? ? + ? + Hizballah (1982-2000) 8 + + + + + + + + + + ETA (1981– 2001) 8 +/- + + + + + + + + + FARC (1992 – 2003) 8 +/- + + + ? + + + + ? Fatah (1967-1984) 8 + + + + + + + + + + AQ (2001-2003) 8 +/- + + + = - + + + + PIRA (1976-1994) 8 + + + + + + + + + + HAMAS (1987– 2001) 8 + + + + + + + + + + Cambodian Freedom Fighters (1998)
9 - - - - - - - + - ?
AIAI (1996– 2001) 11 - - + - - ? + - ? ? AQ (1988-1996) 11 - - + - + - - - - + Islamic Group (94 – 98) 12 - - + + - - - - = = PKK (1984 – 2004) 14 - + - + - - + + = + Jesh-e-Mohammedi (00-04) 14 - + ? + ? ? ? + + ? Islamic Group (89 -93) 15 - + + -
- - + - = = PIRA (1969-1972) 15 - + + - - - + + - - PIRA (1972-1976) 16 - + + +
- - + = = +
Shining Path (1980– 2001) 16 - + + + ? + + + = + ELN ( 1995 – 2003) 16 - + + +
? ? + ? ? ?
43
Tabulation of Independent, Dependent and Control Variables60
Popular Support Arrayed Against High Local Support and High Media Exposure
Organizational Structure Arrayed Against High Standardized Training and High Uniform CI Methods
Controlled Territory Arrayed Against High Local Support and High Communications Security
60 The tabulation charts do not include cases from the chart where the value of the independent variable was unknown. The charts also do not include tabulation of the “low” cases, and so do not add up to 100 percent. Each square represents the percentage of cases scoring “high” for the stated independent variable, for each of the dependent variable values.
PS LS (HIGH) ME (HIGH)
HIGH 79% 82%
LOW 14% 25%
OS ST (HIGH) UM (HIGH)
HIGH 67% 63%
MIX 67% 75%
LOW 14% 14%
CT LS (HIGH) CS (HIGH)
HIGH 78% 59%
LOW 20% 25%
44
Adversary Capability Arrayed Against High Communications Security and High Vetting
Initial Framework Analysis. An analysis of the chart yields some initial insights
into the hypotheses. The data set lends support to Hypotheses 1(A), 2(A), 2 (B) and 3(A).
However, the casual mechanisms driving these outcomes are not discernable without a
more in-depth look at each case. Importantly, case studies will help us determine
whether organizational and environmental changes precipitate or result from variations in
the terrorist group’s counterintelligence capabilities. The data set does not provide
insight into Hypotheses 1(B) and 3(B), which are very difficult to assess at such low
resolution and will only be possible with in-depth case studies.
The data set also provides immediate feedback on Hypothesis 4: Terrorist groups
facing external threats will become increasing centralized and tightly commanded over
time. The data suggest that this hypothesis is mostly accurate. Groups observed over
time appear to migrate or ‘evolve’ to a tighter command structure. Additionally, many
mature terrorist groups in the sample have a tight command structure. The threat-rigidity
hypothesis posits that the move to centralization results from a desire of a group’s leaders
to consolidate control over the organization in response to external threats. Whether
AD CS (HIGH) VC (HIGH)
HIGH 63% 93%
LOW 33% 75%
45
groups centralized control as a result of leadership preference or as a rational response to
an external threat, or for some other reason, is also not discernable from this data set.
One alternative hypothesis is that groups centralize command as increased resources
allow them to afford centralizing the organizational structure, rather than simply as a
response to external threats. For example, groups with more financial resources may
command greater loyalty from well-paid foot soldiers or maintain more frequent contact
with middle managers with better communications systems. The case studies to follow
will help us tease out some of these causal relationships.
The majority of cases roughly fit with the theoretical predictions of the
typological chart. The most glaring conflict between the typological predictions and the
observed outcomes relates to the ‘Damaging CI Exposure Through Media Contact’
variable (3A). The typology predicts that groups with high popular support will expose
themselves counterproductively in the media while groups without popular support will
not expose themselves. In fact, it appears that groups with and without popular support
expose themselves in the media. It may be that many groups without popular support
will strive unsuccessfully to be more popular and in doing so expose themselves. The
case studies may help to tease out this casual mechanism.
One notable observation is that several terrorist group ‘types’ are rarely, or not all,
observed. Not surprisingly, type 10 cases were not observed. Type 10 groups are
probably unlikely to survive very long as they are loosely structured, unpopular, without
territory, but up against a strong adversary. There is only one instance of a type 9 group,
which is also loosely structured, unpopular, and without territory. Interestingly, there is
46
only one example each of types 1, 3 and 5. Each of these types has a tight organizational
structure and a weak adversary, though each is lacking popular support, controlled
territory or both. This may be an unusual combination as terrorist groups with a weak
adversary but tight organizational structure may be more likely to gain popular support
and control territory.
Additionally, there are no observations of type 13 and only one observation of
type 12. Type 12 seems logically unlikely, with a loose structure, no popular support, but
with controlled territory and a strong adversary. The absence of type 13 is a bit more
puzzling. This could suggest that popular terrorist groups facing a weak adversary are
likely to also gain controlled territory, perhaps regardless of the tightness of their
organizational structure.
The four case studies will help to evaluate the casual mechanisms at work in
many of these types. In fact, the four case studies are really ten case studies, as each case
is broken into smaller time periods. This is done to permit a ‘most similar’ case
comparison within each group, between different time periods. This is an ideal case
comparison because other than the shifting dependent variable, the group otherwise stays
the same in the key observable, as well as many unobservable, ways. While within group
comparison is ideal, the study also permits ‘most similar’ case comparison between
several group cases on all three independent variables. That is, in several instances, two
case studies differ on only one variable: Fatah (1964 – 1967) and al Qaeda (1996 – 2001)
differ only on controlled territory, al Qaeda (1996 – 2001) and Fatah (1967 – 1984) differ
only on popular support, al Qaeda (1988 – 1996) and PIRA (1969 – 1972) also differ
47
only on popular support, al Qaeda (1996 – 2001) and the Egyptian Islamic Group (1994 –
1998) differ only on organizational structure, and Fatah (1967 – 1984) and PIRA (1972 -
1976) also differ only on organizational structure.
Comparison of Most Similar Cases (Between Groups) Dependent Variables
Groups Type OS PS CT AD
ST UM LS ME CS VC
Fatah (1964-1967) 2 + - - + + = - - = + AQ (1996-2001) 4 + - + + + + - + + +
AQ (1988-1996) 11 - - + - + - - - - + PIRA (1969-1972) 15 - + + - - - + + - -
AQ (1996-2001) 4 + - + + + + - + + + Islamic Group (94 – 98) 12 - - + + - - - - = =
Fatah (1967-1984) 8 + + + + + + + + + + PIRA (1972-1976) 16 - + + + - - + = = +
From the analysis of the typological framework, we can preliminarily evaluate
these ‘most similar’ cases. For the first set above, comparing Fatah (1964 – 1967) and al
Qaeda (1996 – 2001), the acquisition of controlled territory is correlated with enhanced
communications security and uniform counterintelligence standards. For the second set
above, comparing al Qaeda (1996 – 2001) and Fatah (1967 – 1984), the acquisition of
popular support is correlated with increased counterintelligence support from the
population, though media exposure was present even without popular support. For the
AQ (1996-2001) 4 + - + + + + - + + + Fatah (1967-1984) 8 + + + + + + + + + +
48
third set, comparing al Qaeda (1988 – 1996) and PIRA (1969 – 1972), the acquisition of
popular support is correlated with increased counterintelligence support from the
population and increased media exposure. For the fourth set, comparing al Qaeda (1996
– 2001) and the Egyptian Islamic Group (1994 – 1998), a tighter organizational command
structure is correlated with more standardized training, greater uniformity in
counterintelligence methods, improved communications security and improved vetting
and investigations. For the fifth set, comparing Fatah (1967 – 1984) and PIRA (1972 -
1976), a tighter organizational command structure is correlated with more standardized
training, greater uniformity in counterintelligence methods, and improved
communications security.
One could argue that because groups tend to centralize over time, the correlation
between tight command structures and improved tradecraft is consequence of the terrorist
group’s experience, which leads independently to improved counterintelligence methods.
However, the large-N framework shows that loosely commanded groups with many years
experience (such as the ELN in 2003, the PIRA in 1976, the PKK in 2004 and the
Egyptian Islamic Group in 1998) had inferior counterintelligence training and
standardization relative to tightly commanded groups with fewer years of experience
(such as Fatah in 1964, November 17 in 1980, and Hizballah in 1982).
Importantly, the most frequently occurring types are all given close consideration
in the case studies portion of the dissertation. Groups from type 2 (3 instances), type 8 (9
instances), and type 16 (3 instances) have one or more in-depth case studies devoted to
them. Type 7 (3 instances) is the most frequent type for which there is no in-depth case
49
study. The groups in this type, including Abu Sayyaf (1993 – 2001), LTTE (1999 –
2001) and the Taliban (1990-1996), all have tight structures, high popular support,
controlled territory and a weak adversary. These are groups that dominate their
environment without challenge. In some ways, this makes them a less interesting target
of study, as they enjoy a relatively solid counterintelligence posture without pressure
from a strong adversary to expose and test their strengths and weaknesses.
A final notable observation is that the most common terrorist group is type 8—a
tight organizational structure, high popular support, controlled territory, and a strong
adversary. These features were also common among all terrorist group types: 24 out of 33
had a tight organizational structure, 22 had high popular support, 23 of the groups
controlled territory, and 23 had a strong adversary.
This could be the result of the bias in our sample towards ‘mature’ terrorist groups
—mature groups are subject to greater scrutiny and therefore easier to observe and study.
As discussed above, several immature terrorist groups are incorporated into the data set to
balance out this bias, though mature groups remain overrepresented in the data.
This bias challenges the conclusions we can draw from the data set, suggesting
that the results apply mostly to mature groups and probably less to immature groups. For
example, while mature terrorist organizations may standardize training and
counterintelligence procedures more effectively with a tight organizational structure,
immature groups may fail to standardize procedures regardless of organizational
structure. Immature terrorist groups may not convert local support into a
counterintelligence advantage, even when they enjoy popularity among the local
50
population. Immature groups may not enjoy superior physical and communications
security when they control territory or, more likely, their movements and personnel may
be obvious to the adversary even when they do not control territory. Immature groups
may not tighten their command structure in response to external threats. All of these
‘failures’ of immature groups may contribute to their rapid demise. The three immature
terrorist groups assessed in the large data set tentatively supported the core hypotheses.
Interesting, however, each one of the three immature groups exposed themselves
extensively to the media, even when they did not have popular support, which almost
certainly contributed to their counterintelligence deficits.
From a policy perspective, this bias does not enormously impact the study’s
findings, as immature terrorist groups are by definition more easily defeated and
therefore are less urgent targets of study. Remedying this bias from a theoretical
standpoint, however, is important. If the hypotheses hold true for mature groups but not
immature groups, we should be left wondering: why do these mechanisms only apply to
mature groups? What is it about immature terrorist groups that shelter them from the
forces shaping mature groups? Is their immature and short-lived existence the result of
an overwhelmingly strong adversary, an unpopular cause or a total lack of resources?
While data on the three immature terrorist groups suggests that the core hypotheses do
hold true for immature groups, interrogating these questions more fully will be an
important step in generalizing the study’s results to all terrorist groups.
The case study portion of the dissertation will address this bias by including
among the case studies several terrorist groups that experienced substantial failure in their
51
existence. The Egyptian Islamic Group, for example, was rapidly and entirely routed by
its state adversary even though it was a mature terrorist group. Most importantly, each of
the cases provides insight into the casual mechanisms described by the hypotheses and
allows us to gauge the universality of the mechanisms. Thorough evaluation of the
causal mechanisms will allow us to assess the extent to which a terrorist group’s
organizational structure, popular support, and controlled territory shape its
counterintelligence capabilities, regardless of the group’s ‘maturity’, resources, the
capabilities of its adversary, or the popularity of its cause.
Section Ten: Case Study Selection and Outline
The four in-depth case studies represent the reminder of the study. Each case
study is encapsulated in its own chapter, testing each of the hypotheses but highlighting
one or two of the core hypotheses. Chapter Two focuses on the organizational structure
hypothesis with an in-depth look at the PIRA from 1969 to 1994. Chapter Three focuses
on the popular support hypothesis with a case study on al Qaeda from 1988 to 2003.
Chapter Four focuses on the controlled territory hypothesis with case studies on Black
September and Fatah from 1964 to 1984. Chapter Five focuses on the popular support
hypothesis with a case study on the Egyptian Islamic Group from 1989 to 1998. Chapters
Two and Five also present an in-depth test of the interaction of the terrorist group’s
organizational structure and the adversary’s counterterrorism capabilities. Chapter Six
provides a review of the hypotheses and discusses options for improving
counterintelligence policy in light of the studies key findings.
52
These four cases are selected because they allow us to isolate key variables over
time and, as a result, cleanly observe the effects of our core variables. Each case is
separated into time periods that permit observation of core variable changes while all
other variables are held constant—as stated above, a ‘most similar’ case framework. This
approach is feasible because these particular cases allow for wide variation in the
dependent variables: groups with tight and loose organization structures, high and low
popular support, controlled and no controlled territory, as well as strong and weak
adversaries. Further, the cases represent a wide variation in the independent variables,
depicted groups with meager counterintelligence capabilities and sophisticated
capabilities.
The four cases are also selected for their representativeness. The cases depict a
wide geographical area: Europe (PIRA), North Africa (GI), the Levant (Fatah and BSO),
as well as the Gulf and South Asia (AQ). The cases also span a wide time range, from
1964 to 2003.
The cases are also selected to compliment the large-N data set presented above.
While the data set provided feedback on Hypotheses 1(A), 2(A), 2 (B), 3(A), and 4,
comprehensively testing all the hypotheses, but particularly Hypotheses 1(B) and 3(B),
requires a deep examination only the case study method can offer. For example, the case
studies of the PIRA and the Black September Organization will offer unique insights into
the casual mechanisms posited by Hypotheses 1(B) and 3(B), respectively. The case
studies of Al Qaeda and the Islamic Group will provide additional insights into 2(A) and
2 (B) and all of the cases will provide insight into Hypothesis 4.
53
The case studies will also aid in evaluating and addressing the data set bias
towards mature terrorist groups by facilitating a more thorough understanding of the
causal mechanisms posited by the core hypotheses. Only by breaking down the causal
mechanisms into their component parts can we judge the extent to which our hypotheses
are limited to mature groups.
Finally, the cases are selected because of their relevance to contemporary
counterterrorism efforts. The groups depicted pioneered and made infamous many of
terrorist tactics and guerrilla strategies used by some of today’s most deadly terrorist
groups. Al Qaeda case study insights are directly relevant to current counterterrorism
efforts against the group. The relevance of this set of cases to modern counterterrorism
efforts will facilitate discussions about improving counterterrorism responses and policy
options in the study’s final chapter.
54
CHAPTER TWO: THE PROVISIONAL IRISH REPUBLICAN ARMY
In the early 1970’s, British security forces were steadily dismantling the
Provisional Irish Republican Army (PIRA). British interrogators were collecting
confessions and details of terrorist plots from PIRA detainees and using the information
to locate and capture senior PIRA leaders. By 1978, however, arrests and detentions of
PIRA personnel had dropped dramatically, and those who were captured gave less
information to their British interrogators. How was the PIRA able to dramatically
improve its counterintelligence capabilities so rapidly?
The following case study will show that the PIRA tightened its organizational
structure in the mid-1970s, significantly improving its counterintelligence training and
compartmentation, but in so doing also increased its vulnerability to high-level
penetrations by the British Government. The case will also show that the PIRA chose to
tighten its organizational structure in response to the British Government’s increasingly
effective counterterrorism tactics. The PIRA case offers a good test of Hypotheses 1(A),
1(B) and 4. Though the large-N data set supported each of these hypotheses, only an in-
depth examination of the casual forces driving the observed outcomes will provide
insight into the strength and universality of the hypotheses.
In this chapter, I first provide a discussion of the key hypotheses and alternative
hypotheses, followed by the PIRA case study. I then review the hypotheses and provide
a general assessment of the key lessons offered by the case study for both theoretical and
policy debates.
55
The PIRA case study is broken into three parts. The first part depicts the PIRA in
its earliest stages, from 1969 to 1972, when its organizational structure was relatively
loose and the British government’s counterterrorism capabilities were relatively weak.
The second part describes the PIRA from 1972 to 1976, when its organizational structure
remained relatively loose, while British counterterrorism capabilities improved
significantly. The third part describes the PIRA from 1976 to 1994, when its
organizational structure became tight and compartmented while British counterterrorism
capabilities remained strong. The three parts will illustrate how the PIRA’s intelligence
and counterintelligence capabilities changed in relation to its organizational structure.
While British counterterrorism capabilities shifted over time, the case is broken into three
sub-cases in order to isolate the shift in PIRA organizational structure from the shift in its
adversary’s capabilities.
PIRA Case Study Core Hypotheses
Hypothesis 1(A): With a relatively tighter command and control structure the
PIRA will have superior counterintelligence training and compartmentation.
Hypothesis 1(B): With a relatively tighter command and control structure the
PIRA will be more vulnerable to its adversary’s efforts to develop high-level penetrations
and exploit the group’s standardized counterintelligence procedures.
Hypothesis 2(A): With relatively greater popular support the PIRA will have
greater counterintelligence support from the local population.
Hypothesis 2(B): With relatively greater popular support the PIRA will be more
likely to expose itself in its efforts to maintain popular support.
56
Hypothesis 3(A): With relatively more controlled territory the PIRA will have
superior communications security, physical security and counterintelligence vetting.
Hypothesis 3(B): With relatively more controlled territory the PIRA will be more
vulnerable to its adversary’s efforts to track the group’s gross financial, logistical and
personnel movements.
Hypothesis 4: The PIRA will become increasing centralized and tightly
commanded over time in the face of external threats.
Alternative and Falsifiable Hypotheses
The alternative hypotheses argue the opposite of the core hypotheses. Thus, the
first alternative hypothesis is that tighter organizational structure will not produce
superior counterintelligence training and compartmentation or greater vulnerabilities to
high-level penetrations. Conversely, if the group has a loose organizational structure but
does not suffer from inferior counterintelligence training and compartmentation, then the
alternative hypothesis is correct and the core hypothesis is falsified.
The second alternative hypothesis is that popular support will not result in greater
counterintelligence support from the local population or greater vulnerability to exposure
in the media. Thus, if the group wages a popular support campaign but does not induce
counterintelligence vulnerabilities as a result and does not benefit from increased local
support, then the alternative hypothesis is correct and the core hypothesis is falsified.
The third alternative hypothesis is that controlled territory will not result in
greater physical and communications security or greater vulnerabilities to tracking the
group’s gross movements of personnel and logistics. Thus, if the group operates from
57
controlled territory but does not benefit from more secure communications and vetting,
then the alternative hypothesis is correct and the core hypothesis is falsified.
The fourth alternative hypothesis is that a terrorist group facing an increasing
menacing adversary will not become more centralized and tightly commanded over time.
Thus, if the group faces an increasing threat from its adversary but does not centralize its
decision-making and tighten its command and control, then the alternative hypothesis is
correct and the core hypothesis is falsified.
Control Variables: Alternative Explanations
The control variables do not remain perfectly constant in the PIRA case study,
opening up the possibility that the control variables account for some of the change in the
dependent variables. First, the British Government increased its counterterrorism
capabilities dramatically between Period One (1969-72) and Period Two (1972-76). Any
erosion in PIRA counterintelligence capabilities between these periods is most likely a
result of this shift, rather than shifts in organizational structure, popular support or
controlled territory. For Hypotheses 1(A) and 1(B), pathologies of the PIRA’s
counterintelligence training and compartmentation may result from the British
government’s increasing capabilities rather than from the PIRA’s loose organizational
structure. For Hypotheses 2(B) and 3(B), PIRA counterintelligence vulnerabilities
relating to its popular support campaigns and controlled territory may also result from the
British government’s increasing capabilities. Period One provides some control for all of
these effects, however, as the British counterterrorism capabilities are weak in this period
58
while PIRA organizational structure, popular support and controlled territory remained
unchanged into Period Two. Thus, the PIRA’s hypothesized counterintelligence
weaknesses should be present in Period Two as they are in Period One.
The PIRA case provides a good test of Hypotheses 1(A) and 1(B) as all variables
remain constant from Period Two to Period Three while only the PIRA’s organizational
structure shifts. The case also provides a good test of Hypothesis 4, as all variables
remain constant between Period One and Period Two, while only the adversary’s
capabilities shift.
The PIRA’s resources are held constant over all three periods, reducing the
likelihood that shifts in resources are accounting for the changes in counterintelligence
strengths and vulnerabilities.
Finally, the PIRA undoubtedly experienced normal organizational learning over
these three periods. The case will need to show, however, that the hypothesized
counterintelligence strengths and innovations resulted from the core variables rather than
organizational learning. The case will do this by illuminating the casual mechanisms
driving the counterintelligence outcomes and demonstrating that despite normal
organizational learning, the observed counterintelligence strengths and innovations would
not have occurred without the core variable shift.
59
PIRA Case Study: Independent Variables
PIRA
Adversary CT
Capability
Org Structure
Resources
Controlled Territory
Popular Support Type
1969 - 1972 Low Low High Yes High 15
1972 - 1976 High Low High Yes High 16
1976 - 1994 High High High Yes High 8
PIRA Timeline: 1969 - 1972
PIRA Background
In the late 1960’s the British government’s handling of the crisis in Northern
Ireland was increasing aggravating residents of Northern Ireland. The Irish Republican
Army (IRA) had been fighting the British occupation with varying intensity since 1919,
but some IRA members worried that its resistance efforts were flagging. The PIRA was
officially created in August 1969 when IRA members Gerry Adams, Sean MacStiofain,
August 1969: PIRA splits from the IRA
July 1970: British overreact to PIRA rioting in Lower Falls
August 1971: British initiate Operation Demetrius
January 1972: Bloody Sunday Massacre
1972: PIRA offers British Government a truce but cannot hold to the ceasefire
60
Billy McKee, Joe Cahill, Leo Martin, and Seamus Twomey decided that the IRA was
failing to provide adequate defense for the people of Northern Ireland against “the forces
of British imperialism.”61
Period One: 1969 to 1972
Adversary Counterterrorism Capabilities. Prior to 1969, the British had amassed
considerable counterinsurgency experience in Malaya, Kenya and Cyprus and the English
Intelligence Center in Sussex became the historical storehouse of British
counterinsurgency experience.62 Despite these experiences, the British had difficulty
translating these lessons to the Northern Ireland battlefield. The British Army, the Royal
Ulster Constabulary’s (RUC) Special Branch, British Internal Security Service (MI5) and
British Special Intelligence Service (MI6) were the British government’s main
counterterrorism forces in Northern Ireland and each faced challenges in gathering
intelligence, coordinating policing and intelligence activities, and resisting military
overreaction to the PIRA’s terrorist operations.
Between 1969 and 1972 the British government’s intelligence on the PIRA was
severing lacking. When the conflict began, the RUC’s Special Branch, a police
intelligence unit, had only 20 officers.63 Historically, the Special Branch’s intelligence
gathering had been focused on the IRA and produced very little intelligence on the new
61 Peter Taylor, “Provos: The IRA and Sinn Fein,” Bloomsbury, London, 1997, 60. 62 Peter Taylor, “Beating the Terrorists? Interrogation at Omagh, Gough and Castlereagh,” Penguin Books, Middlesex, UK: 1980, 20. 63 Nicholas Davis, “Ten Thirty Three: The Inside Story of Britain’s Secret Killing Machine in Northern Ireland,” (Mainstream Publishing: Edinburgh, 1999, 32.
61
young hardliners of the PIRA.64 Special Branch files were based on the IRA’s previous
military campaign in the late 1950’s and contained information that largely concerned
families that had IRA connections in the country districts in the 1950s.65 An MI5 team
sent to Northern Ireland in the early 1970’s to supplement Special Branch activities found
that Special Branch did not have a single address for any high-ranking PIRA personnel.66
The British Army’s intelligence gathering was also unsophisticated. The Army
relied on a policy of “tea and sympathy.” Army officers on patrol would stop and chat
with locals, in an effort to gain their confidence, and follow-up with a visit form an
intelligence officer should the locals seem willing to provide information on the PIRA.67
Thus, an overall picture of the Republican activity was constructed through casual
contact with locals and the occasional four-hour detainment of more ‘interesting’
suspects.68
In this early period, British security forces suffered from inept policing and
counterterrorism techniques. British counterterrorism activities initially were militarily
passive, relying heavily on fostering good community relations. The British strategy in
late 1969 and late 1970 was to avoid confrontation with the broader Catholic community
in Northern Ireland by keeping a low-profile in Catholic areas and opening lines of
communication to representatives of the Catholic minority.69 The policy inadvertently
64 Davis, 32. 65 Taylor (1980), 19. 66 Davis, 33. 67 Davis, 33. 68 Davis, 33. 69 Colonel Michael Dewar, The British Army in Northern Ireland (Arms and Armour: UK, 1996), 49.
62
created “no-go” areas for British forces, which the PIRA exploited to extend its influence
in the Catholic communities.70 A low-profile for the British also meant fewer arrests, less
patrolling, and fewer house searches, which allowed the PIRA to operate openly in these
critical “no go” areas.71
When the PIRA-led rioting began in the summer of 1970, the British Army
overcorrected its permissive counterterrorism policy. In July 1970, they imposed a
curfew on a prominent Catholic thoroughfare, known as the Falls Road—an incident
which later became known in Republican circles as the “Rape of the Lower Falls.”72
Standoffs and gun-battles between PIRA and British soldiers led to an even more severe
British reaction, including wide-spread arrest and internment operations. In August 1971,
the British initiated Operation Demetrius, in which British forces were permitted to arrest
any individual “under suspicion of acting, haven acted, or about to act in a manner that
disturbed the peace in Northern Ireland.”73 Operation Detritus was a disaster on account
of the British government’s poor intelligence on the PIRA. The British army rounded up
hundreds of innocent people and very few key PIRA members, which further alienated
the Catholic population from them.74
Operation Demetrius was also an example of poor British counterintelligence.
One reason the British failed to apprehend many PIRA volunteers was because the PIRA
knew the operation was coming. The British Army had ‘telegraphed’ the operation by
70 Dewar, 64. 71 Dewar, 64. 72 Tim Pat Coogan, “The Troubles: Ireland’s Ordeal 1966-1996 and the Search for Peace,” Roberts Rinehart Publishers, USA: 1996, 112. 73 Taylor (1997), 92. 74 Taylor (1997), 93.
63
conducting a series of dry-runs and ‘try out’ swoops in late July—an obvious sign to the
Republican community that a big operation was imminent.75 This evidence, coupled with
a tip-off from clandestine sources, gave the PIRA advanced warning of the British forces’
plans.
A second mistake the British made was to increase heavy-handed interrogations
of PIRA suspects. As the conflict with the PIRA heated up, the British began more
aggressive use of the “five techniques” of interrogation, which included hooding, sleep
deprivation, white noise, a starvation diet, and standing for hours spread-eagle against the
wall, accompanied by verbal harassment and occasional blows.76 A public inquiry
exposed the interrogation abuses and left the Catholic community feeling increasingly
alienated from the British government and sympathetic towards the PIRA.77
The PIRA’s car-bomb innovation further complicated the British government’s policing
efforts. In order to stop the flow of car bombings in Northern Ireland the British sealed
off traffic from city centers and set up numerous checkpoints. This effort placed a large
burden on the security force’s resources and failed to prevent many car bombings.78
Organizational Structure. The PIRA’s leadership consisted of an elected 12-
member Provisional Irish Republican Army Executive, which then elected a seven
member Army Council. The Army Council, which included the General Headquarters
75 J. Bowyer Bell, The Secret Army: The IRA. (Transaction Publishers: New Brunswick, 1997, 381. 76 Coogan, 127. 77 Coogan. 78 Bishop and Mallie, 172.
64
Staff (GHQ), elected MacStiofain the provisional Chief of Staff—the primary position of
authority within the PIRA.79
Borrowing from the IRA’s structure, the PIRA was modeled after the British
Army with brigades, battalions, and companies.80 In Belfast, the PIRA had three
battalions under its influential Belfast Brigade: the First Battalion covering Upper Falls
and Ballymurphy, the Second Battalion covering the Lower Falls and Clonard, and the
Third Battalion covering Crumlin Road and the Short Strand.81 Every company, in
theory, had a Commanding Officer (O/C), a training officer, a quartermaster and an
intelligence officer, in addition to the rank-and-file PIRA members, known as
‘volunteers’.82
Despite the army-like structure, PIRA leaders exercised only loose command and
control over the organization and had relatively little tactical or operational control over
the activities of PIRA companies. J. Bowyer Bell, a scholar of the Republican
movement, argued that the PIRA relied on ‘control by consensus’—units worked within a
rough framework and decisions were made by those “close to the pointed end of the stick,
often at the last possible moment.”83 IRA scholar Ed Maloney, argued that there was
virtually no central control of the PIRA from Dublin or even the Belfast Brigade: “IRA
79 Brian A. Jackson, John C. Baker, Kim Cragin, John Parachini, Horacio R. Trujillo, Peter Chalk, “Aptitude for Destruction, Volume Two: Case Studies of Organizational Learning in Five Terrorist Groups” (RAND Corporation: Santa Monica, 2005), 96. 80 Ed Maloney, A Secret History of the IRA, (W.W. Norton Company: New York, 2002), 87. 81 J. Bowyer Bell, The IRA: 1968-2000: Analysis of a Secret Army. (Frank Cass Publishers: London, 2000, 226. 82 Brendan O’Brien, The Long War: The IRA and Sinn Fein 1985 to Today, (O’Brien Press: Dublin, 1993, 39. 83 J. Bowyer Bell, The IRA: 1968-2000: Analysis of a Secret Army, 162.
65
companies were encouraged to go their own way. This led to a large amount of
operations…a bank would be robbed, a bomb downtown, a booby trap for the Brits,
snipes, a float—where three or four heavily armed IRA members would drive randomly
around their streets in the hope of encountering a British army patrol to fire upon.”84
During this early period, the GHQ suffered from a general lack of control over
PIRA volunteers and inability to coordinate operations among battalion commanders. In
one incident Gerry Adams, then commander of the Ballymurphy units, had to detain a
PIRA Belfast unit at gunpoint to keep them from meddling with military affairs in his
area of operations.85 In another incident, in March 1971, undercover PIRA volunteers
assassinated three young off-duty British soldiers, despite PIRA guidelines not to target
off-duty soldiers. The killing was so heinous that the PIRA immediately issued a denial
of responsibility.86
Throughout 1971, the attacks against policemen and soldier grew more reckless,
endangering civilians and bystanders.87 It became clear that guidelines issued by Dublin
were malleable and transgressing them would not result in disciplinary action.88 This
became painfully clear to the PIRA when offered a truce to the British in the summer of
1972, but subsequently could not prevent its members from conducting terrorist
operations. During the 14 days of the truce PIRA volunteers were suspected of killing at
84 Maloney, 107. 85 Maloney, 88. 86 Patrick Bishop and Eamonn Mallie, “The Provisional IRA” (Heinemann, London: 1987), 136. 87 Bishop and Mallie, 141. 88 Bishop and Mallie, 137.
66
least six Protestants, though the PIRA leadership denied responsibility and even alleged
that some of the killings might have been done by “freelancing” elements.89
One advantage the PIRA gained from this lack of control, Bell argues, is that
PIRA units could keep a very high operational attack tempo because of considerable
operational freedom at low levels. This worked in favor of PIRA interests when PIRA
leaders needed to sustain or escalate its operational tempo.90
Resources. When the PIRA split from the IRA in 1969 its resources, in terms of
recruits and finances, were relatively meager. There were an estimated 50 to 60 members
in Belfast and even fewer guns.91 At the time of the August 1970 riots, there were an
estimated 100 to 120 volunteers in Belfast and between 300 and 500 Republican
supporters in the population, known as auxiliaries, who could be relied upon to relay a
message or hide weapons.92 The PIRA quickly amassed a deep reservoir of recruits,
weapons, and financial supporters, due to the British government’s inept and heavy-
handed response to PIRA activity in Northern Ireland.
Revelations of detainee abuse following Operation Demetrius resulted in many
new recruits coming forward in Belfast and in areas where the PIRA previously had little
support.93 In 1970, the PIRA planted 213 bombs leading to 25 deaths. By the end of
1971, the PIRA had increased those numbers to 1,756 bombs and 174 deaths.94 The
89 M.L.R. Smith, Fighting for Ireland? The Military Strategy of the Irish Republican Movement, (Routledge: London, 1995), 119. 90 J. Bowyer Bell, The IRA: 1968-2000: Analysis of a Secret Army, 142. 91 Maloney, 87 & Jackson et al (2005), 98. 92 Bishop and Mallie, 108. 93 Coogan, 128. 94 Coogan, 131.
67
PIRA was enjoying a network of safe houses, sympathetic medical personnel, and around
one thousand ‘auxiliary’ volunteers.95
One of the PIRA’s most important resources was its access to controlled territory.
Following the internment debacle, the PIRA was able to develop a number of “no go”
areas where they could operate openly, patrolling the streets with weapons on display,
and controlling the entire area with barricades and checkpoints.96 One of the benefits of
operating openly was that PIRA volunteers could engage in a wider range of training and
testing activities. For example, the volunteers often used their controlled territory in
South Armagh to test new weapons and prototype bombs.97
The PIRA’s ability to establish and control territory areas varied by region.
County Derry, which shared a border with the Republic of Ireland and whose population
was seventy-five percent Catholic, was home to PIRA-controlled “no go” areas.98
Belfast’s Catholic population was far smaller and less suitable for PIRA control, though
the ghettos of Belfast became effective “no go” areas for British forces.99
Weapons and recruits were also critical resources for the PIRA. By 1972, the
organization was inundated with weapons, collected from sympathetic Irish-American
communities, partners in the Middle East, and international arms markets.100 The PIRA
had also been flooded with recruits. PIRA companies were growing so large that they
were forced to split and new members came to outnumber the veteran volunteers needed
95 Coogan, 113. & Maloney, 103. 96 Bishop and Mallie, 152. 97 Jackson et al (2005), 104. 98 O’Brien, 51. 99 Bell (1997), 382. 100 Maloney, 107 & Jackson et al (2005), 98 & Taylor (1997), 108.
68
to train and test them.101 With its ranks swollen, PIRA terrorist activity reached a high
point in May 1972 with 1,200 military operations.102
Popular Support. The PIRA’s level of popular support in the 1969 to 1972 period
was intimately related to the British government’s failings in Northern Ireland. The
British army’s policy of aggressive house-to-house searches was one of the greatest
sources of anger in the Catholic communities.103 The PIRA’s ability to play a law
enforcement role in its controlled territories, punishing criminals and deterring crime in
areas where traditional law enforcement forces had pulled back, gave the PIRA an added
boost of support.104 Ultimately, it was the British government’s blunders in Northern
Ireland—the large-scale raids, bombing out roads at the Irish border, and Bloody Sunday
in January 1972—that led to an upwelling of support for the PIRA. Gerry Adams
summed up the result: “Thousands of people who had never been republicans now gave
their active support to the IRA; others, who had never had any time for physical force
now accepted it as a practical necessity.”105
The PIRA knew that British military overreactions aided the Republican cause
and often sought to induce security crackdowns. The PIRA successfully compelled
British forces to increase security operations outside of the Catholic ghettoes, in the
Loyalist and economic centers of Northern Ireland—PIRA bombings in Belfast forced
the British to set up a tedious series of checkpoints, body-searches, and vehicle searches
101 J. Bowyer Bell, The IRA: 1968-2000: Analysis of a Secret Army, 81 and 225. 102 Maloney, 112. 103 Raymond Gilmour, Dead Ground: Infiltrating the IRA (Little Brown and Company, London, 1998, 21. 104 Smith, 93. 105 Taylor (1997), 83.
69
in the heart of the city’s economic center.106 PIRA volunteers are alleged to have made
anonymous telephone calls to the security forces and misidentified people in Catholic
areas as PIRA members, causing a flurry of arrests of innocent Catholics for which the
British would be blamed.107 The PIRA also knew it could suffer as a result of its own
military zealotry. Bloody Friday, a PIRA bombing incident that accidentally killed seven
civilians and two soldiers in Belfast, allowed the British to initiate a series of ambitious
raids against the PIRA with relatively little public backlash in Northern Ireland.108
The PIRA also used intimidation to garner population support in the early period.
Though most intimidation and knee-capping was directed at criminal or ‘anti-social’
elements in the population, the PIRA also targeted Catholic women that fraternized with
British soldiers on the streets or in Army discos.109 If Catholic women were caught
fraternizing with British soldiers in the street or in the British Army’s discotheques they
were sometimes tied to a lamppost while hot tar was poured over their head and upper
body—a technique known as “tarring and feathering.”110
PIRA Intelligence. In the 1969 to 1972 period, PIRA intelligence gathering was
ad hoc and haphazard, but was often good enough to serve the PIRA’s immediate goals
of terrorizing the British and Protestant communities of Northern Ireland.
106 Bishop and Mallie, 127. 107 Tony Geraghty, “The Irish War,” HarperCollins Publishers, London, 1998, 52. 108 Maloney, 117. 109 Taylor (1997), 87. 110 Taylor (1997), 88.
70
Importantly, PIRA intelligence was focused on simple military operations, rather
than assessing the political climate in Britain or Northern Ireland.111 In 1970, the core of
the PIRA campaign involved a series of bombs aimed at economic targets, which would
have required only basic surveillance.112 The strategy worked well because the PIRA had
access to plenty of explosives and the British could not defend every building.113
For many targets, extensive pre-operational ‘intelligence’ was unnecessary for
PIRA units. PIRA volunteer Martin Meehan describes the daily routine for PIRA units in
the Ardoyne in this early period: “members [would] set off in pairs, usually by car, to
cruise the narrow streets in search of a target…instructions were vague…They were
simply under orders to engage any troops who entered the district.”114 PIRA volunteer
Brenden Hughes describes this technique as a ‘float”: “That’s a two-man car with one
man driving and one man in the back with a particular weapon…They’d be floating
around waiting until a target came along…some [operations] would have been
opportunistic.”115 Sometimes the PIRA’s targets were carefully chosen—army foot
patrols and vehicle convoys would be monitored to find patterns, and sometimes hoax
warnings were used to lure soldiers into an ambush.116
In this early period, the PIRA received a great deal of intelligence support from
sympathetic local populations. In areas where population support was very strong, such
111 J. Bowyer Bell, The IRA: 1968-2000: Analysis of a Secret Army, 241. 112 Bishop and Mallie, 127. 113 J. Bowyer Bell, The IRA: 1968-2000: Analysis of a Secret Army, 276. 114 Bishop and Mallie, 149. 115 Taylor (1997), 109. 116 Taylor (1997), 109.
71
as South Armagh, PIRA units relied on locals to gather details of troop activities.117 In
the “no go” areas, where population were particularly supportive, PIRA units could
openly patrol the streets and check the identities of everyone coming in or out of the
area.118 In some areas, British soldiers would be greeted by hen patrols—local women
and children rattling garbage can lids, blowing whistles, and following the patrols alley to
alley—in order to alert PIRA units to impending raids.119
Additional population support for PIRA intelligence came from the young men
that lived in the areas of operation. Men who were too young to serve as PIRA
volunteers would be used as couriers or lookouts for snipers.120 Former British Colonel
Michael Dewar recalls that in one operation, boys would signal to hidden PIRA members
when a British patrol had entered a kill zone, allowing the PIRA members to keep a safe
distance for concealment and quick escape.121
There is little evidence to support the claim that the PIRA had penetrated the
security services or the British government during the 1969 to 1972 period. PIRA
member Joe Cahill alleges, however, that the PIRA was tipped off to Operation
Demetrius by a PIRA mole working in the office of the Minister of Home Affairs.122
Cahill and PIRA volunteer Sean MacStiofain, allegedly traveled to different company
117 Bishop and Mallie, 159. 118 Geraghty, 55. 119 BB, 78 & Gilmour, 21. 120 Bishop and Mallie, 117. 121 Dewar, 71. 122 Brendan Anderson, “Joe Cahill: A Life in the IRA,” (The O’Brien Press: Dublin, 2002), 223.
72
areas 48 hours before the operation, telling volunteers not to sleep in the own houses.123
Though the claim seems sensational, it is corroborated by the fact that the vast majority
of key PIRA volunteer eluded British capture by going on the run well before the
operation began.124
PIRA Counterintelligence. In the 1969 to 1972 period, PIRA counterintelligence
was ad hoc and disorganized, but was also relatively effective when pitted against British
capabilities.
The PIRA did not have a counterintelligence staff or unit in this period, so every
PIRA volunteer was informally responsible for detecting informers.125 Former PIRA
official Brenden Hughes argues that because a unit would undertake a series of
operations every day, any unexplained absence would have raised suspicion among
members of the unit.126
The British did not seem to have any significant penetrations of the PIRA in this
early period, so the PIRA could survive with haphazard counterintelligence tradecraft.
Potential PIRA volunteers would directly contact a local recruiter and would then attend
an overt Sinn Fein political meeting where they could volunteer to join the violent side of
the movement.127 The advantage of recruiting locally was that most volunteers would be
known in their community and vetted by their neighbors.128
123 Anderson, 223. 124 Taylor (1997), 92. 125 J. Bowyer Bell, The IRA: 1968-2000: Analysis of a Secret Army, 244. 126 Peter Taylor, Brits: The War Against the IRA, (Bloomsbury: London, 2001), 133. 127 Sean O’Callaghan, The Informer (Bantam Press: London, 1998), 27. 128 Bell (2000), 226.
73
Despite the PIRA’s haphazard counterintelligence practices, it was able to stay a
step ahead of the British in many cases. Tipped off to Operation Demetrius in August
1971, PIRA volunteers escaped to safe houses. PIRA scholar Tony Geraghty recalls
asking PIRA leader Leo Martin where he slept at night, to which Martin held up a key
ring with 30 different door keys.129 The PIRA also benefited from recruiting volunteers
that had no Republican background, called ‘unknowns’ or ‘sixty-niners’, to assure that
some portion of the organization would be unknown to the Special Branch.130 The
natural counterintelligence advantage fell to the PIRA in this case, as many of the most
recruitable volunteers, the young and unemployed, were also those on which the Special
Branch had little intelligence.131
Population support provided the PIRA with a counterintelligence advantage in a
number of cases. The medical assistance provided by sympathetic populations within the
Republic of Ireland proved invaluable, as medical personnel in Northern Ireland would
sometimes report suspicious injuries to the police.132 PIRA controlled territory in the
countryside, such as South Armagh, allowed the PIRA to relax its counterintelligence
profile and operate more openly.133 Staying ‘hidden’ in urban areas was more
challenging. Some PIRA leaders realized early on that South Belfast, a religiously-mixed
129 Geraghty, 48. 130 Bishop and Mallie, 145. 131 Taylor (1980), 19. 132 Geraghty, 63. 133 Bishop and Mallie, 159.
74
area with a large transient student population, was an ideal hiding ground and so decided
to use the area as a base.134
Some of the PIRA’s counterintelligence advantages were based on more coercive
practices. Starting in the autumn of 1970, the PIRA took measures against members of
the community who socialized with British soldiers. As described earlier, young girls
caught socializing with soldiers would sometimes be tied to a lamppost with a placard
hung around their neck announcing their offense.135 The organization dealt even harsher
penalties to touts, who were volunteers suspected of passing information to the British.
The PIRA carried out its first execution in January 1971. John Kavanagh had ignored
warnings to avoid contact with the police and so was apprehended, tried in a PIRA
‘court’, and then shot in the back of the head.136
During the 1969 to 1972 period, the PIRA also suffered as a result of its
counterintelligence sloppiness. Following a PIRA gunbattle with British soldiers in
South Armagh, two volunteers proceeded to brag about the operation while drinking in a
bar and were subsequently arrested.137 Many PIRA members made no attempt to conceal
their PIRA affiliation, in some cases walking in public with balaclava helmets, carrying
guns and stopping cars.138 During the halt in hostilities in 1972, many of the PIRA
volunteers that had previously guarded their affiliation openly mixed in public with
134 Maloney, 104. 135 Bishop and Mallie, 133. 136 Ibid, 138. 137 Ibid, 157. 138 Gilmour, 25.
75
known PIRA men, which was all very visible to, and later exploited by, British
intelligence.139
Summary. In the 1969 to 1972 period, the PIRA maintained a loose
organizational structure and a wealth of resources and controlled territory. The PIRA
also benefited from a relatively weak adversary, prone to military overreaction and
unpopular mass arrests. As predicted, the PIRA’s operational and counterintelligence
postures were ad hoc rather than standardized. The PIRA occasionally exposed its
personnel and political agenda in its efforts to generate popular support through open
Sinn Fein meetings in the local communities.
Timeline: 1972 - 1976
Period Two: 1972 to 1976
Adversary Counterterrorism Capabilities. By 1973, the British government’s
counterterrorism capabilities had dramatically improved, and continued to improve
through 1976.140 Specific counterterrorism improvements included intelligence
139 Maloney, 113. 140 Bell (2000), 227.
1973: British begin Operation Motorman
July 1973: British capture PIRA leader Gerry Adams
1974: British pass Prevention of Terrorism Act
1975: British have most Republican groups in England infiltrated
February 1975: PIRA announces ceasefire but cannot hold to the terms
76
collection through house raids, interrogations and penetrations of the PIRA, as well as
improved policing coordination and more politically-sensitive military interventions.
House raids conducted by British forces reached a peak in 1973, when security
forces searched one-fifth of all houses in Northern Ireland.141 Raids and interrogations
were reoriented towards gathering information about future PIRA operations rather than
gathering evidence to facilitate criminal prosecution of past operations.142 The British
parliament passed the Prevention of Terrorism Act in 1974, which aided British
counterterrorism efforts by allowing terrorist suspects to be detained for up to seven days.
143 The Prevention of Terrorism Act proved an intelligence windfall for the British as
they could arrest suspects without a warrant and interrogate them for a week without
bringing charges against them.
A secret PIRA document confiscated in 1977 from a high-ranking PIRA leader
revealed that British detentions were taking a severe toll on the organization: “The three
day and seven day detention orders are breaking volunteers and it is the Republican
Army’s fault for not indoctrinating volunteers with a psychological strength to resist
interrogation.”144
British penetrations of the PIRA also improved.145 British forces were able to
recruit many cash-deprived young Catholics during their interrogation by offering them a
141 Allen Feldman, “Formations of Violence: The Narrative of the Body and Political Terror in Northern Ireland,” University of Chicago Press: Chicago, 1991, 88. 142 Feldman, 88. 143 Taylor (1997), 174. 144 Coogan, 345. 145 Maloney, 125.
77
financial reward for spying on the PIRA.146 British also stepped up its effort to penetrate
the Irish community in Great Britain hoping to forestall support to PIRA units.147 British
forces were also able to skillfully use their interrogation centers, to meet with PIRA
informants. Uniformed British battalions sometimes staged mass arrests to identify new
informers and to provide cover for meetings with ongoing informants.148
In one case, the British recruited the Belfast Brigade quartermaster, Eamon
Malloy, during an interrogation but knew that releasing him back to the street quickly
without a criminal trial would raise suspicion in the PIRA ranks.149 The British invented
a cover story for Malloy, which was that he had escaped through a door that was
carelessly left unlocked at the interrogation facility. The story was good enough to get
Malloy back into the PIRA ranks where he was able to provide British forces with details
about arms dumps and the location of hard-to smuggle weaponry—intelligence that
decimated the PIRA arsenal.150 The British worked hard to recruit quartermasters during
this time because they would know where weapons were and, up until the PIRA’s
reorganization, who was using them.151
The British Internal Security Service MI5 recruited many new officers and
employed new techniques in order to improve surveillance operations against the
146 Davis, 34. 147 Bell (1997), 400. 148 Geraghty, 137. 149 Maloney, 134. 150 Ibid, 141. / Malloy’s cover story was that he slipped out an open door at the interrogation center and away from his British captors. 151 Taylor (2001), 149.
78
PIRA.152 MI5 also began to plant listening devices in suspects’ cars and homes—in one
scenario, MI5 would covertly ‘award’ a suspect with a weekend holiday trip through a
staged radio contest and then wire the house with microphones once the individual left
for the weekend.153
British forces used creative intelligence analysis to improve operations against the
PIRA. Special Branch and other intelligence were able to work out which units were
responsible for which operations based on the PIRA’s well-defined geographical
distribution. British forces used this analysis to aid interrogations and achieve more
precise targeting.154
British intelligence agencies also employed more sophisticated offensive
intelligence operations, which targeted internal PIRA morale. The British frequently
announced that informant information had led to an arrest, when it had not, or announced
an exaggeratedly high figure for the spoils of a PIRA bank robbery, which sometimes
resulted in a spate of internal PIRA punishment shootings.155
A PIRA spokesperson aptly summed up the British counterterrorism capabilities
in this period, referring to a specific British operation: “We were had. We knew we had
fallen for it. It was very much in the mould of the [British Army Intelligence] operations,
clever, well-planned and brilliantly executed…They almost destroyed us. They created
paranoia in the ranks and left us severely damaged.”156
152 Taylor (1980), 145. 153 Ibid, 146. 154 Maloney, 156. 155 Bishop and Mallie, 187. 156 Coogan, 267.
79
Organizational Structure. The PIRA’s command and control structure in period
two remained loose and nominally organized in brigades, battalions, and companies. The
flood of PIRA recruits was incorporated, sometimes haphazardly, into this structure.157
By 1973, British forces began to capture many PIRA leaders but the PIRA’s loose
command structure allowed it to recover quickly from these losses in some cases.158 J.
Bower Bell argues that when the British captured C/O of the Belfast Brigade Gerry
Adams, the Brigade took “only a week or so to recover.”159 The quick recovery, defined
as the ability to continue conducting terrorist operations as the same pace, scale, and
expertise, proved particularly valuable to the Belfast unit—following Adams’ arrest in
July 1973, the next five C/O’s of the Brigade were arrested in succession within a year.160
The PIRA’s resilience was due in part to the operational independence of PIRA
units. Units in the countryside, in particular, had little or no operational connection to
other PIRA units and sometimes no contact with the Army Council or a representative
from the GHQ Staff for six months at a time.161 Units in East Tyrone and South Armagh
were effectively under the control of clan chieftains, Kevin Mellon and Tom Murphy,
respectively.162 Ed Maloney quotes a rural PIRA volunteer describing the relationship
between these units and central leadership: “The leadership would never try to give them
orders…There was virtually no control from the center. They mounted operations
against the British, and the job of the leadership was to provide resources, training, guns,
157 Bishop and Mallie, 254. 158 Bell (1997), 399. 159 Ibid. 160 Ibid, 405. 161 Bell (2000), 233 & Bishop and Mallie, 246. 162 Maloney, 160.
80
explosives.”163 PIRA units deployed in London also exercised considerable autonomy.
In 1974, the London unit was averaging about one attack a week in spite of limited
communication with the PIRA’s ‘overseas operations’ headquarters in Dublin.164
The relative autonomy of PIRA units made them difficult to control. Units
throughout Northern Ireland would often act without clearance from the GHQ, seeking
revenge for sectarian killings or conducting special operations. In one case, the PIRA
unit in Andersonstown kidnapped a German businessman without official authorization
and when the German died of a heart attack, the PIRA disowned the attack out of
embarrassment.165 Lack of control also imperiled some of the PIRA’s political strategies.
For example, on February 9, 1975, the PIRA Army Council announced a ceasefire after
discussions with British officials and a month later a PIRA unit in Derry killed an RUC
constable.166
The loose command and control structure also affected personnel management.
Talented individuals were not easily shared or transferred around to where they might be
needed most.167 In addition, there was no formal plan for retiring PIRA members.
Former PIRA member Sean O’Callaghan recalls that volunteers came and went all the
time and sometimes their absence was not even noticed.168
163 Maloney, 160. 164 Bishop and Mallie, 202. 165 Bell (1997), 406. 166 Ibid. 167 Ibid, 232. 168 O’Callaghan, 85.
81
The PIRA continued to lack a formal training plan for its recruits between 1972
and 1976.169 Former PIRA member O’Callaghan recalls that when he was a young
volunteer in the mid-1970s, training was informally conducted by a member of his unit
and focused mostly on weapons skills.170
Resources. PIRA resources did not shift significantly from the early 1970’s to the
mid-1970’s. One of the big changes from early to mid-1970s was the PIRA’s loss of its
urban ‘no go’ areas.171 In spite of this, the PIRA still had a flood of recruits, and often
too many to deploy.172
Bordering areas in the Republic of Ireland continued to offer safe haven to PIRA
units.173As the British improved their counterterrorism capabilities, however, they began
to challenge the PIRA’s controlled territory more effectively. Operation Motorman, one
of the British government’s most important counterterrorism operations, worked well
because it was politically sensitive and hemmed in PIRA ‘no-go’ areas in the urban
centers of Belfast and Derry.174 The operation took place on July 31, 1973 and was
largely successful because it followed a particularly bloody PIRA attack known as
Bloody Friday—an operation that killed six civilians, including two Catholics and two
children. The attack gave the British license to reclaim some of the PIRA’s urban
controlled territory and construct military forts in some of these areas, which severely
restricted the PIRA’s freedom of movement and allowed the British to surveil thousands
169 Bell (2000), 233. 170 O’Callaghan, 30. 171 Bell (2000), 226. 172 Ibid. 173 Ibid, 233. 174 Bell (1997), 393.
82
of civilians with Republican sympathies.175 The British grip on the PIRA strongholds in
West Belfast grew so tight, that the PIRA was forced to move its operational
headquarters to the southern outskirts of the city.176
The number of PIRA suspects arrested, interned, or charged with criminal
offenses increased from 100 to 1,000 between 1972 and 1973.177 On a single day in July
1973, the PIRA saw at least sixteen of its most experienced leaders arrested by the
British, including the entire staff of the Third Brigade.178 Following Operation
Motorman, the British set up security checkpoints in urban centers and security towers in
the countryside. Urban units continued their bombings campaigns but at a reduced level
and though the countryside was still considered ‘bandit country,’ PIRA volunteers had to
move about more cautiously or operate only at night.179
Popular Support. Popular support for the PIRA also did not shift significantly
from the early to mid-1970’s. Local support continued to be an important asset in PIRA
intelligence and counterintelligence operations. One of the most important forms of
support from the population was nondenunciation—pretending not to know of any PIRA
personnel or activities.180
Popular support also aided intelligence collection. PIRA ‘spies’ in tax and social
security offices passed useful information to the group, such as the home addresses of
175 Maloney, 117. 176 Ibid. 177 Ibid, 128. 178 Ibid, 133. 179 Bell (2000), 227. 180 Bishop and Mallie, 228.
83
policemen or personal information about members of the loyalists paramilitaries.181 In
1973, a telephone engineer with PIRA sympathies offered to tap British Army
Communications when his company assigned him to install a new back-up telephone
exchange at the Army’s Lisburn headquarters.182 The engineer was not a member of the
PIRA, but had developed strong sympathies for the PIRA after he saw the Army kill a
stone-thrower in Andersonstown.183
The PIRA also continued to use intimidation and other ‘heavy-handed’ techniques
to gain the population’s acquiescence. Police informers were dealt with harshly, and
knowledge of the PIRA informant policy was enough to compel many citizens to lend
their cars and houses for PIRA operations without question.184 The majority of residents
did not approve of the organization’s intimidation methods, but found it preferable to
tolerate rather than resist the PIRA.185 Former PIRA member Raymond Gilmour recalls
that people who knew each other fairly well might talk about PIRA policies freely in the
confines of their own homes, but talking about the PIRA in public was considered
dangerous.186 Though there was no appreciable difference in population support,
sympathy for the PIRA was beginning to thin as the shock of internment wore off and
reckless PIRA thuggery in the ghettoes continued.187
181 Bishop and Mallie, 228. 182 Taylor (2001), 158. 183 Ibid, 158. 184 Bishop and Mallie, 228. 185 Gilmour, 40. 186 Ibid. 187 Bishop and Mallie, 173.
84
PIRA Intelligence. The PIRA’s intelligence collection capability in this period
was relatively advanced. In some cases, the PIRA’s intelligence collection could be
considered sophisticated, for example, when the PIRA tapped key phones at the British
Army’s Lisburn headquarters.188
For the most part, however, the PIRA’s intelligence collection supported very
basic operations against static or soft targets. Successful intelligence collection
operations included locating the London home of the Adjunct General of the British
Army, the bus ferrying British soldiers between Manchester and Catterick Camp, British
Army Headquarters at the Grand Central Hotel, Special Branch Chief in Omagh, Judge
Rory Conaghan, and Magistrate Martin McBirney.189 In some cases, soft civilian targets
would require even less operational intelligence—pubs frequented by off-duty soldiers
were likely easy surveillance targets.190
Even the PIRA’s more sophisticated intelligence operations were performed in a
relatively ad hoc and haphazard manner. The successful bugging of Lisburn Army
Headquarters depended on a fortuitous access of a Republican sympathizer who, through
trial and error, eventually tapped the line that led to the Army’s intelligence unit ‘G2
Int.’191 The tap itself was not sophisticated, consisting of a voice-activated tape recorder,
and a descrambling device stolen from the Army headquarters.192
188 Taylor (1997), 162. 189 Bell (1997), 404 & 411, 424 & Coogan, 190. 190 Taylor (1997), 173. 191 Taylor (2001), 158. 192 Ibid, 158.
85
Even the relatively successful London operations in the mid-1970’s were based
on ad hoc intelligence collection. Units would get intelligence, orders, and suggestions
from headquarters through couriers, but would usually choose their own targets and
gather the critical operational intelligence only weeks before the operation.193
Though intelligence collection was basic and often disorganized, the PIRA made
good use of prisons for intelligence analysis. Long Kesh prison, home to many arrested
PIRA volunteers, developed its own command and leadership structures and became a de
facto think tank for the organization.194 Some of the PIRA’s most innovative analysis,
including that which inspired the PIRA’s reorganization, was prepared by prisoners at
Long Kesh.195
PIRA Counterintelligence. PIRA counterintelligence in this period was still
relatively ad hoc and disorganized, and was increasingly haggard by improvements in
British counterterrorism efforts.
In spite of its unstructured counterintelligence practices, the PIRA enjoyed several
counterintelligence successes in this period. Some PIRA units continued to recruit
volunteers with no criminal records who were unlikely to be known to British forces.196
The PIRA also occasionally forced non-volunteers to drive truck bombs to their targets in
order to keep PIRA volunteers out of the reach of security forces.197 For some
193 Bishop and Mallie, 200 & Coogan,(1993), 293 & Taylor (1997), 155. 194 Maloney, 149. 195 Ibid. 196 Ibid, 125. 197 Bell (1997), 405.
86
operations, PIRA units would change the license plates and paint jobs of cars to be used
in operations to keep from drawing the suspicion of security forces.198
The PIRA continued to enjoy counterintelligence support from the Catholic and
Republican community. The community’s knowledge of what the PIRA did to police
informants could be enough to keep them from offering information to security forces.199
The British government’s ‘confidential phone’ operation, in which any citizen could
leave an anonymous message about PIRA activities, was a failure for the British.200
Gerry Adams argued that it was impossible for the majority of Catholics to see the PIRA
from the same perspective as British forces did: “It’s not staff officer Paddy Mcguire
[Adams explained]…it’s Mrs. Maguire’s boy.”201 The PIRA also recognized the
counterintelligence threat that came from operating in areas where it lacked popular
support, such as in England. By the early 1970’s, the British had infiltrated many pro-
Republican organizations in England and, as a result, Sinn Fein did not allow its British
supporters to open overseas branches.202
The PIRA would occasionally offer amnesty to informants, if they told the PIRA
everything about their activities and other British informants.203 This was a particularly
clever strategy, in theory, as it potentially allowed the PIRA to reduce the number of
informants in their ranks, assess damage done by British informants, and adjust PIRA
operations to reduce damage from current and future British intelligence operations. On
198 Taylor (1997), 155. 199 Bishop and Mallie, 228. 200 Ibid, 230. 201 Ibid. 202 Ibid, 201. 203 Taylor (2001), 149.
87
the down side for the PIRA, offering amnesty regularly may have reduced a volunteer’s
perceived risk of becoming British informant.
The PIRA further bolstered its counterintelligence posture by exploiting the
talents of volunteers in prison. PIRA inmates at Long Kesh analyzed a string of British
counterterrorism successes and discovered that PIRA volunteer Kevin Malloy was most
likely an informer. Inmates passed this message to the leadership outside and Malloy
was eventually tricked into admitting his role as an informer.204 PIRA inmates would
debrief and interrogate newly arrived inmates and, in one case, prompted two ‘fake’
inmates in the Crumlin Road jail to confess to working as informants for the RUC’s
Special Branch.205 Interrogations were sometimes brutal—a warden at Long Kesh prison
discovered that PIRA interrogation devices included piano wire and electric current.206
The PIRA used interrogations to enhance its counterintelligence practices outside
of the prisons as well. The organization used interrogation to learn from informant Kevin
Malloy that the British had PIRA leader Brenden Hughes and an important PIRA safe
house under constant surveillance.207 The PIRA also learned of several major British
covert action programs by interrogating suspected informants Kevin McKee and Seamus
Wright.208 In addition to revealing the presence of more British informants among the
PIRA, McKee and Seamus revealed a laundry service run by British spies to test the
204 Maloney, 134. 205 Coogan (1996), 266. 206 Ibid, 267. 207 Maloney, 138. 208 Taylor (2001), 135.
88
clothing of Republicans for explosives residue.209 These counterintelligence victories
demonstrate the PIRA’s effective interrogation practices, but also reveal that the PIRA
had limited systematic counterintelligence capabilities as the penetrations were detected
as a result of non-routine counterespionage interrogations.210
In this period, the PIRA’s disorganized and ad hoc counterintelligence practices
cost the organization dearly. Part of the problem stemmed from the PIRA’s growing
membership—as the organization grew, security tended to slacken.211 In some areas,
such as the Divis Flats, security problems arose because PIRA volunteers were easy to
target as they patrolled streets openly with riffles displayed.212 Lack of training and
sloppiness also contributed to counterintelligence problems. British police named this
sloppiness the ‘Paddy factor.’213 PIRA scholar Tim Pat Coogan argues that in the mid-
1970s anyone could stroll into a PIRA establishment, such as a bar in Andersonstown,
and observe PIRA volunteers and supporters mixing together and singing about the
battalion to which they belonged—a potential intelligence windfall for any police agent
present.214
The British government’s most lethal counterterrorism platforms during this
period were its interrogation ‘holding centers,’ at Castlereagh, Gough Barracks, and
Strand Road. One PIRA volunteer recalled: “Men were breaking in the police stations.
209 Maloney, 120. 210 Ibid, 120. 211 Bishop and Mallie, 254. 212 Maloney, 123. 213 Bell (1997), 406. 214 Coogan (1993), 353.
89
We’d hear of people handing over 25 or 30 names at a time.”215 The British used this
intelligence to arrest top PIRA leadership, including Sean MacStiofain (November 1972),
Sean Keenan (November 1972), Martin Meehan (November 1972), Ruairi O’Bradaigh
(December 1972), Martin McGuinness (December 1972), Joe McCallion (December
1972), Anthony Doherty (January 1973), Leo Martin (January 1973), John Martin
(February 1973), Seamus Twomey (September 1973), Kevin Mallon (September 1973),
and Ivor Bell (April 1974), to name a few.216 In June of 1973, British forces arrested 23
known PIRA volunteers and 13 known officers in a period of five days.217 In July,
security forces arrested 17 members of the Belfast Brigade, including the three most
wanted men in Belfast—senior PIRA leaders Gerry Adams, Tom Cahill, and Brenden
Hughes.218
The PIRA was so weakened by the string of arrests, that PIRA leaders Gerry
Adams and Martin McGuinness regarded this time in PIRA history as the closest the
organization would come to defeat.219
Summary. In the 1972 to 1976 period, the PIRA maintained a loose organizational
structure as well as a high level of resources and access to controlled territory. The
British counterterrorism capabilities dramatically improved in this period, presenting the
PIRA with a significant, existential challenge. The PIRA’s operational and
counterintelligence postures remained ad hoc rather than standardized, and PIRA leaders
215 Maloney, 155. 216 Taylor (1997), 152-158 & Coogan (1996), 159-160. 217 Ibid, 156. 218 Ibid. 219 Ibid, 197.
90
were systematically captured as a result. The British Government’s ability to take
advantage of the PIRA’s lack of training, also known as the “Paddy factor,” is a clear
example of the critical importance of standardized counterintelligence training for
terrorist groups.
Timeline: 1976 - 1994
Period Three: 1976 to 1994
Adversary Counterterrorism Capabilities. British counterterrorism capabilities
remained high, and steadily improved, from 1976 through 1994. British security forces
continued to successfully coordinate operations, extract information through interrogation
centers, recruit informants, and moderate military activity to garner public sympathies.
The RUC took the lead in the war against the PIRA in 1976—the job that had
previously fallen to the British army—which led to increased cooperation between the
RUC and other military and intelligence agencies.220 The RUC’s Special Branch and
military intelligence were sharing information and running some agents together by the
220 Taylor (1997), 202.
1976: PIRA initiates restructuring
1977: PIRA trains all its members in counterinterrogation
June 1979: RUC uncovers PIRA technical intelligence operation
1980: All PIRA cells have a dedicated ‘security’ officer
1992: PIRA bomb the Baltic Exchange causing 800 million pounds of damage
91
mid-1980s.221 The RUC turned itself into a top-notch policing and intelligence
organization, having developed the most comprehensive network of informants in
Northern Ireland, a world-renown forensic science department, and their own equivalent
of the British Special Air Service (SAS) (a surveillance unit known as Echo 4 Alpha),
which increased collaboration between the police, SAS, and MI5.222 Supplementing the
RUC’s work was the Force Research Unit (FRU), a British military intelligence squad,
which managed its own spies and informants.223 The British army also fielded the
Military Reconnaissance Force (MRF), which conducted surveillance and intelligence
operations against the PIRA.224 Beginning in the mid-1980s, the SAS increased its
operations in Northern Ireland and used sophisticated electronic surveillance and
informants to conduct ambushes and captures.225
British interrogation centers continued to produce information on the PIRA but it
also became fertile ground for recruiting informants. The British had to rely on ‘turning’
vulnerable PIRA volunteers—security services could not infiltrate the PIRA with their
own spies due to the PIRA’s cellular structure and the group’s fear of ‘unknown’
Republicans.226 Captured volunteers would be given the choice of a long jail sentence or
money and protection if they agreed to spy on the PIRA, and not surprisingly some chose
to spy.227 Interrogation centers such as Castlereagh also benefited from a brutal
221 Taylor (1997), 256. 222 O’Brien, 162 & Geraghty 131. 223 Coogan (1996), 210. 224 Coogan, 245. 225 Taylor (1997), 268. 226 Ibid, 256. 227 Ibid.
92
reputation and some captured volunteers would quickly give up information to avoid the
RUC’s infamous torture practices.228
Through the 1990s, the RUC was getting a large portion of its daily intelligence
on the PIRA from informants run by Special Branch, estimated to have been in the
hundreds.229 The British government also began to use supergrasses—informants who
were offered amnesty, a new life, and a pension—to provide evidence in court against
PIRA volunteers.230 British forces cleverly targeted senior PIRA officers that were
alleged to have left the organization under a cloud of disagreement as these individuals
were most vulnerable to the informant ‘pitch.’231 The British started rumors of
informants in the PIRA—the British knew that PIRA cells would tend to lie low for up to
several months after such an incident for fear of also being betrayed by the phantom
informant.232
The British also infused their counterterrorism strategy with an increasing
technological sophistication. When the RUC took the counterterrorism helm in 1976, it
centralized collected intelligence in massive databases—every suspect brought into the
police station would have personal information, including aliases, nicknames,
neighborhood, accent, scars, and tattoos, loaded into a database.233 By the late-1980s,
intelligence agents would plant listening devices in suspects’ houses that could transmit
228 Taylor (1980), 193. 229 Geraghty, 157. 230 Coogan (1996),195. 231 Davis, 36. 232 Ibid, 111. 233 Taylor (1980), 61.
93
for months and upload recorded material to a helicopter flying overhead.234 The Royal
Air Force provided aerial photography to British forces and used infra-red and thermal
imaging to search for buried arms caches.235 The British also used sophisticated
computer software to monitor large numbers of telephone calls, including all cross-border
calls and all calls to known Republicans.236 The increased surveillance capability made it
difficult for the PIRA to operate in the open, even in the PIRA’s countryside
strongholds.237
British counterterrorism practices improved steady through the 1990s, setback
only occasionally by coordination problems, gaps in informant intelligence, or difficulty
in targeting an increasingly stealthy PIRA.238
Organizational Structure. The PIRA’s command and control structure changed
dramatically from period two to three. The structural change began in the autumn of
1976 and involved a tightening of command and control over the organization, which
increased control of PIRA volunteers by top leadership and included the
compartmentalization of PIRA Active Service Units (ASUs) into cells.239
The PIRA made these structural changes in direct response to improvements in
British counterterrorism practices. The PIRA’s ‘restructuring strategy’ memo, known as
the Staff Report, was found on arrested PIRA member Seamus Twomey in December
234 Taylor (1997), 276. 235 Geraghty, 131. 236 Bell (2000), 206. 237 Bell (1997), 615. 238 Bell (1997), 536 & Coogan (1996), 246. 239 Coogan (1996), 345.
94
1977.240 The document spelled out the motivation for and the ramifications of PIRA
restructuring:
“This old system with which the Brits and the [Special] Branch are familiar has to
be changed. We recommend reorganization and remotivation…We emphasize a return to
secrecy and strict discipline. Army men must be in total command of all sections of the
movement…Anti-interrogation lectures must be given in conjunction with indoctrination
lectures…Cells of four volunteers with be controlled militarily by the
Brigade’s/Command Operations Officer…Cells should operate as often as possible
outside of their own areas: both the confuse Brit intelligence (which would increase our
security) and to expand out operational areas.”241
The PIRA was able to ‘tighten’ its command and control structure by
compartmenting PIRA units.242 Compartmentalization was designed to keep most of the
members of one cell from knowing the members of another cell and dependent on top
leadership for resources and direction. Cells would have one leader that reported to the
Brigade Operations Officer so only the leader of the cell would be in contact with
members of the Brigade Staff.243 Importantly, compartmentalization would make it
difficult for a British interrogator to extract much information from a captured
volunteer.244
240 Coogan (1996), 205. 241 Ibid, 345-347 & Appendix A. 242 In spite of the push to reorganize the entire PIRA, the restructuring process was not uniform across the organization. Units in rural areas fought harder to retain their old structures and operational habits. 243 Urban, 1992, 31. 244 Taylor (1997), 211.
95
The PIRA’s second organizational shift involved dividing the PIRA into two
commanding units, the Northern and Southern Command, and subordinating the
previously influential Southern Command to the Northern leadership. The Northern
Command, created in 1976, gave leaders from the North much greater control over daily
operations in the six counties of Northern Ireland and the four border counties of the
Republic of Ireland, where the majority of fighting occurred.245 The Southern Command
retained control over military action abroad and was responsible for facilitating weapons
procurement for the Northern fighters.246 The position of Northern Commander became
the most important position in the PIRA and the individual occupying that post had the
final say in strategic and operational matters.247 Over time, the Northern Command’s
control over the PIRA grew—by 1986 the Northern Command was vetting most
operations and area commanders were expected to describe prospective operations to the
Chief of Staff in detail.248
The PIRA also restructured its prison command and control structures. Inmates
could not longer select a prison O/C by vote, but instead would submit a list of candidates
to the Army Council, which would then select one of the nominees to assume the role of
O/C—a move that significantly increased the influence of the Army Council in the
prisons.249
245 Taylor (1997), 213. 246 Bell (2000), 227. 247 Maloney, 158. 248 Ibid, 317. 249 Ibid, 148.
96
The effort to tighten and compartmentalize the PIRA was largely successful, but it
was neither complete nor problem-free. Because the PIRA remained relatively dependent
on public support for its operations, volunteers were in some cases known to the local
population and to each other.250 Volunteers also broke with secrecy practices during the
Hunger Strike protests and marches when they could be seen talking and marching
together in the open.251
Though compartmentalization reduced contact between PIRA leaders and low-
level volunteers, it increased contact between PIRA leaders and mid-level volunteers,
making those volunteers a more valuable target for the British. PIRA volunteer Raymond
Gilmour, a driver for his cell, became an ideal British informant because he was in
regular contact with a wide range of PIRA members throughout Derry.252 PIRA
counterespionage officer Freddie Scappaticci, became another key British informant as
he had access to the PIRA’s innermost secrets—upcoming missions, arms cache
locations, travel and security details, bombing and assassination targets, and which PIRA
volunteers were suspected of being informants. Scappaticci was able to protect himself
from suspicion by rigging counterespionage investigations and framing ‘innocent’ PIRA
members.253
The restructuring also increased PIRA leaders’ knowledge of and power over the
organization, which made them more enticing targets for British forces. Because the 250 Bell (2000), 136 & Kevin J. Kelley, “The Longest War: Northern Ireland and the IRA,” (Lawrence Hill and Co.: Westport, Connecticut, 1988), 285. 251 Taylor (1997), 257. 252 Ibid, 263. 253 Matthew Teague, “Double Blind: The Untold Story of How British Intelligence Infiltrated and Undermined the IRA,” The Atlantic Monthly, April 2006.
97
PIRA depended more heavily on this cadre of leaders, every leadership loss would affect
the PIRA more deeply.254
Compartmentation occasionally generated operational coordination problems. In
theory, cell leaders would deconflict their operations by coordinating their activities via
the Brigade Commander. At times, however, one cell’s operations could compromise the
logistical base or safety of another clandestine cell.255
Increased top-down command and coordination also blunted the PIRA’s
spontaneous edge.256 Unpredictability had made the PIRA a hard target in the 1970s and
some of that was lost when PIRA leaders standardized the organization’s operations and
tradecraft.257 For example, the PIRA in South Armagh had resisted sharing its radio-
controlled bomb technology with the rest of the PIRA for fear of having it captured and
studied by the British—which is exactly what happened when Northern Command began
to share the bomb technology with other PIRA units.258
In spite of these challenges, the restructuring was on balance a success for the
PIRA. First and foremost, the compartmented structure provided a host of
counterintelligence advantages. In addition, the PIRA was able to exert greater control
over its personnel. A higher degree of control allowed the Northern Command to
coordinate Northern Ireland-wide attacks and make rapid alterations in military tactics
254 Smith, 189. 255 Jackson et al (2005), 129. 256 Ibid, 205. 257 Maloney, 160. 258 Ibid.
98
more feasible.259 Improved control also equipped the organization to support advanced
training and increased specialization in PIRA units.260 Finally, the PIRA was better
prepared to increase or scale-back operations to maximize public support for its
campaign.261
Perhaps the most convincing evidence on this ledger was the British
government’s admission that the PIRA had become significantly more sophisticated.
Humphrey Atkins, Secretary of State for Northern Ireland, spoke about the PIRA in July
1979: “The first six months of this year have shown a marked rise in the level of
terrorism and have demonstrated that we are up against a more professional enemy,
organized on a system of self-contained, close-knit cells which make it difficult to gather
information.”262
Resources. The PIRA’s resources in the 1976 to 1994 time period remained high.
The PIRA’s rosters were purposely slimmed down following reorganization,
commanding between 300 and 400 active duty volunteers in Northern Ireland by the
early 1980s.263 The PIRA continued to draw on 1,000 ‘auxiliary’ supporters who
provided safe houses and transportation assistance.264 Full time active service members
were expected to be ready at a moments notice and were even paid by the PIRA—though
259 Maloney, 160. 260 Jackson et al (2005), 125. 261 Bell (1997), 592-593. 262 Maloney, 171. 263 Dewar, 161. 264 O’Brien, 161.
99
only about 20 pounds per week.265 The PIRA assured itself of a steady supply of recruits
through its PIRA ‘boy scouts’ movement.266
Border and countryside areas, such as South Armagh, remained the PIRA’s main
controlled territories. The RUC sources claimed that there was an almost total lack of
informants in South Armagh.267 A British military assessment from the time remarked
that there were areas in Northern Ireland and the Republic of Ireland where the PIRA
could act with relatively impunity: “the Republic [of Ireland] provides many of the
facilities of a classic safe haven so essential to any terrorist movement…”268
In contrast, non-controlled territories were far more vulnerable to British
surveillance. J. Bowyer Bell argues that nationalist areas of the city began to resemble
low-security prisons: “There were cameras and night sights, hidden spotters, bought
informants, erratic patrols and undercover police, computer banks and those who kept
track of milk delivered and clothes taken to the cleaners.”269 Belfast was cut by road
blocks and barriers and traffic had to flow through choke points, while unmarked cars
and hidden observation posts recorded all suspicious activities.270
The PIRA also did not lack for weaponry in this period. By October 1986 the
PIRA had smuggled approximately 300 tons of Libyan weapons into Northern Ireland,
and had hidden the weapons in secret dumps.271 This was supplemented with a steady
265 Gilmour, 178. 266 Ibid, 229. 267 O’Brien, 206. 268 Coogan (1996) 214. 269 Bell (1997), 470. 270 Bell (2000), 138. 271 Maloney, 292 & Taylor (1997), 277 & O’Brien, 129.
100
stream of weapons smuggled from the United States in small shipments that were hard
for law enforcement to detect.272 Though the PIRA always wanted more weapons, they
always seemed to have plenty to continue their campaign.273
It is probable that the quality of PIRA personnel and their expertise increased
from 1976 to 1994. By the 1990s, the average PIRA volunteer was in his mid-20s to late
30s, in contrast to the earlier periods when the average volunteer was in his late teens.274
Volunteers improved their technological sophistication, deploying more deadly bombs
and preventing more volunteer deaths due to premature detonations.275 In 1993, police
discovered a PIRA electronics engineering lab in the Republic of Ireland, where the
PIRA had put young electronics graduates to work on making and testing homemade
electronic detonators.276
Popular Support. The PIRA popular support remained high from 1976 through
1994. The countryside, including border areas and South Armagh, continued to offer the
greatest source of popular support. Many of these areas initially wished to remain neutral
in the conflict in order to not attract police attention, but rough searches, planting of
weapons, and abrasive checkpoints, turned the population against the police.277 In the
Republic of Ireland, the PIRA had an estimated 50,000 to 100,000 sympathizers, based
272 Bell (1997), 438. 273 Ibid, 566. 274 O’Brien, 206. 275 Geraghty, 206. 276 O’Brien, 280. 277 Bell (2000), 212.
101
on those who attended commemorations, made their opinions known, or signed
petitions.278
The PIRA had by the late-1970s grown even more savvy about cultivating public
support. The top leadership required that any potentially contentious operation, such as
an assassination or operation that endangered civilians, receive top-level clearance.279
This care was reflected in the dramatic decline in civilian deaths caused by the PIRA in
this period—while security force deaths were approximately the same between 1976 and
1977, civilian dropped from 243 to 67 in that period.280 The PIRA’s Green Book states:
“Resistance must be channeled into active and passive support with an on-going process
through our actions, our education programmes, our policies of attempting to turn the
passive supporter into a dump holder, a member of the movement…”281
The PIRA also sought to undermine its adversaries’ popular base. A PIRA
analysis in 1977 estimated that a terrorist campaign in Northern Ireland might evoke a
Loyalist overreaction and thereby reduce popular support for Protestants.282
The PIRA’s reorganization both helped and hindered its quest to win popular
support. On the one hand, the reorganization allowed the PIRA to plan and coordinate
operations that did not alienate the public.283 On the other hand, compartmentation and
the increased secrecy drew PIRA volunteers away from daily interaction with the average
278 Bell (2000), 235. 279 Bishop and Mallie, 250 & Maloney, 317. 280 Bell (1997), 440. 281 The PIRA’s Green Book. 282 Dewar, 117. 283 Smith, 145.
102
citizen of Northern Ireland.284 One PIRA volunteer argued that less contact with the
population eventually led to less familiarity and trust between the PIRA and the public.285
PIRA Intelligence. The PIRA increased the sophistication of their tactical
intelligence collection operations from 1976 to 1994. Though PIRA never acquired a
capacity to systematically gather strategic or political intelligence, the organization’s
survival rarely depended on this type of intelligence collection before political
negotiations began in 1994.286
The PIRA’s military operations usually followed the same basic procedure:
scouting teams would case an area, safe houses would be rented, explosives would be
moved in, cars used for the operational would be acquired, intelligence would be
gathered by volunteers conducting basic foot surveillance, and then the bomb would be
delivered to its target.287 Intelligence collection didn’t need to be highly sophisticated to
be effective.
The PIRA eased the tactical intelligence burden by selecting targets that were
generally vulnerable to observation. PIRA soft targets included civil servants, fuel, food,
and cleaning contractors, British Telecom and Standard Telephones, shipping and bus
companies that transported soldiers, vending machine supplies, and retired members of
the various British security forces.288 Harder targets included British soldiers, members
284 O’Brien, 161. 285 Ibid. 286 Bell (1997), 470. 287 Ibid, 597. 288 Bell (2000), 227.
103
of the RUC and UDR, and members of Loyalists paramilitaries.289 Even an RUC officer ,
however, had considerable vulnerabilities—RUC officers were easy to spot and follow,
walking around in official uniforms and stationed in immobile bases.290 The PIRA also
grew more proficient at tracking troop patrol and police movements.291 PIRA operations
would often follow the path of least resistance, seeking vulnerable targets close to
home—targets which required relatively less sophisticated intelligence collection. J.
Bowyer Bell put it succinctly: “If the lights in London were to be turned off, the IRA
bombed the power stations rather than tinkered with the computers.”292
Static targets were preferred because they were more easily observed and, by
definition, could not be hidden or moved. The PIRA mounted attacks on Downing
Street, the Grand Hotel in London, an RAF officer’s club in Germany, and RUC stations
across Northern Ireland.293 The PIRA also successfully targeted VIPs. Among their
favorite targets were British judges involved in prosecuting PIRA volunteers. The
organization assassinated Judge William Doyle, Magistrate William Staunton, Magistrate
Martin McBirney, Judge Rory Conahan, and Lord Chief Justice Sir Maurice Gibson,
Northern Ireland’s second most senior judge.294 Other victims of PIRA assassinations
included several Ulster politicians, assistant governor of Long Kesh prison, the director
of an American-owned Dupont factory in Derry, the British Ambassador to the
Netherlands, a prominent retired British Ambassador, and the prominent author of The
289 Bell (2000), 228. 290 O’Brien, 163. 291 Interview with former USG counterterrorism official (3/1/2006). 292 Bell (2000), 229. 293 Ibid, 247 & Taylor (1997), 269-271. 294 Geraghty, 114.
104
Guinness Book of World Records, after he had offered 100,000 pound reward for
information leading to the arrest of PIRA volunteers.295
PIRA surveillance continued to be strong in this period. RUC stations and bases
were regularly watched and the model and license plates of RUC vehicles were
recorded.296 Detectives working against the PIRA could be observed as they gave
evidence against the organization in court.297 Patient PIRA surveillance occasionally
produced dramatic operational successes. In 1979, surveillance of British convoy activity
in Country Down allowed the PIRA to ambush a British truck convoy that left 18 soldiers
dead.298 Also in 1979, patient observation of former British Ambassador Lord
Mountbatten and the Gardai forces protecting him allowed the PIRA to assassinate him
on his private boat while he vacationed in Ireland.299
The PIRA also benefited from improvements in technical surveillance collection.
In June 1979, the RUC raided three houses in Andersonstown and stumbled upon a
command post filled with radios, unscrambling equipment, sophisticated monitors,
military-grade transmitters, position fixing devices, and telephone taps routed through the
British Telecom network. 300 301 Most surprisingly, the RUC discovered detailed
transcripts of the RUC’s Operation Hawk—a major surveillance operation against the
295 Coogan (1996),194-196 & Taylor (1980), 158 & Bell (1997), 443. 296 Taylor (1997), 258. 297 Taylor (1980), 157. 298 Bell (2000), 229. 299 Bell (1997), 451. 300 The PIRA’s telephone taps in the British Telecom Network included the private line on the Dunmurry residence of the Army General commanding the Army garrison. [Bell (2000), 246] 301 Bell (1997), 474.
105
PIRA, initiated in early 1979.302 Operation Hawk had been tracking PIRA leadership and
the PIRA had been listening in and adjusting its operations.303 PIRA leadership had even
deliberately moved their people around to discover what code names the RUC was using
for them.304 It isn’t difficult to imagine that the PIRA leadership also used this technique
to discover which volunteers were unknown to the RUC, and therefore more useful for
particularly sensitive activities or operations. The PIRA also used this technical
collection windfall to call off risky operations, move out of unsafe locations, and refine
their bombs by listening to RUC post-operation assessments.305
The PIRA had actually begun to acquire radio equipment capable of breaking into
police and Army communications networks in the early 1970s, but it wasn’t until the late
1970s that they acquired the number of radios and the technical expertise to sift quickly
through security force frequencies and lock in on a particular target.306 This technical
surveillance capability also allowed the PIRA to cut back on the number of volunteers
conducting labor-intensive foot surveillance.307
There is some evidence that the PIRA used open sources to supplement secret
collection activities. J. Bowyer Bell argues that a close reading of open sources helped
the PIRA to conduct several operations, including the attempted assassination of
Margaret Thatcher at the Grand Hotel.308 Former PIRA volunteer Raymond Gilmour
302 Bell (2000), 246. 303 Bell (1997), 474. 304 Ibid. 305 Bell (2000), 246. 306 Bishop and Mallie, 323. 307 Ibid. 308 Bell (2000), 247.
106
argues that checking the local news was a trusted source of intelligence: “…every IRA
man tuned in to the BBC’s early morning Northern Ireland bulletin…[which] always
gave a catalogue of all the previous night’s bombings, shootings, hijackings, knee-
cappings, riots, arrests, and arms finds.”309 It is alleged that PIRA volunteers sometimes
used public sources, such as the “Who’s Who” book, to gather biographical information
for assassination operations.310
There is also evidence that the PIRA occasionally collected human intelligence
through interrogations and penetrations of British security elements, including the
RUC.311 The PIRA used a seductress, as known as a ‘honey trap,’ to control a vulnerable
Maze prison guard, John Christopher Hanna, who was subsequently given a life sentence
for helping the PIRA.312 PIRA prisoners reported gathering valuable intelligence from
Loyalist prisoners—one PIRA prisoner commented: “The Loyalists generally talk in
jail…[h]alf of them haven’t even got a clue that they are giving away information.”313
Interrogations proved to be a fruitful source of intelligence. By interrogating
confirmed RUC informant Peter Valente in 1981, the PIRA was able to get the names of
six more British informants.314 Interrogations were also used to control damage caused
by British capture and interrogation of PIRA volunteers. It was standard practice to
subject volunteers to an extensive debriefing after they were released from a British
309 Gilmour, 177. 310 Jackson et al (2005), 126. 311 Ibid, 125 & Bishop and Mallie, 320. 312 Taylor (1980), 97. 313 Bishop and Mallie, 273. 314 Ibid, 320.
107
interrogation center 315 Debriefers could evaluate the state of RUC intelligence by
learning what questions they were asking PIRA captives and what captives has told
them.316
Prisons turned out to be a good source of intelligence analysis and collection for
the PIRA. Prisons were thought of as ‘think tanks’ for the organization. The PIRA’s
‘Green Book’, a manual on the organization’s mission and intelligence and
counterintelligence procedures, was written by PIRA prisoners in the mid-1970s and later
smuggled out.317 The PIRA regularly used false priests in order to lure new prisoners
into confessing to acting as informants for the British.318 Prisoners frequently used visits
from friends and family to pass intelligence to the organization in the field.319
In its later years, the PIRA collected more intelligence in support of reducing
unintended civilian casualties. In 1992, the PIRA bombed the Baltic Exchange causing
800 million pounds in damage. However, because the bomb was timed to harm no one, it
killed only three people.320
The PIRA reorganization had a noticeable effect on the PIRA’s intelligence
operations. PIRA operations were far less hectic than in the early 1970s, with more
planning and operational dry-runs.321 Compartmentalization protected senior PIRA
leaders from the routine arrests and detentions they were subject to in the early 1970s, 315 Gilmour, 223. 316 Bishop and Mallie, 322. 317 Ibid, 275. 318 Gilmour, 40. 319 Liam Clarke, “Broadening the Battlefield: The H-Blocks and the Rise of Sinn Fein,” (Gill and Macmillan: Dublin, 1987), 67. 320 Bell (1997), 631. 321 O’Brien, 203.
108
which helped them keep valuable experience and knowledge in the field and out of
British prisons.322 The reorganization also allowed the PIRA to train its volunteers more
thoroughly in intelligence techniques and impress upon them the valuable role they
played as the “eyes and ears” of the organization.323
PIRA Counterintelligence. The PIRA counterintelligence capabilities increased
dramatically from the second to third period. After its reorganization was initiated in
1976, the hemorrhage of volunteer arrests slowly subsided. By 1978, there were 465
fewer charges for paramilitary offenses than in the year previous.324
The PIRA leadership’s increased control of the organization played a key role in
counterintelligence improvements. For the first time, volunteers from across the
organization were given strict orders to keep a low profile, to not be seen in each other’s
company or in the company of known republicans, and to refrain from activities that
would draw attention to themselves.325 All recruits were required to go through a series
of background checks and read the PIRA’s counterintelligence-heavy ‘Green Book’
before they could be officially admitted into the organization.326
By the 1980s, all PIRA units in Northern Ireland had a ‘security’ officer, who
enforced secrecy standards, and the PIRA set up an entire security department to vet
recruits and conduct counterespionage investigations and interrogations.327 One of the
security department’s first investigations exposed volunteer Peter Valente as an RUC
322 Maloney, 157. 323 Jackson et al (2005), 123-125. 324 Smith, 145. 325 Taylor (1997), 257 & Coogan (1996),345-347. 326 Maloney, 154 & Gilmour, 96. 327 Bishop and Mallie, 3.
109
informant in 1980.328 Within the PIRA, security department volunteers gained the
unpopularity of policemen, lurking around bars in Belfast to develop hunches and pick up
investigative leads.329 The security department executed ‘confirmed’ informants and
deliberately left executed individuals in public places as a warning to others.330 Former
PIRA volunteer Raymond Gilmour recalled that when he was suspected of being an
informer, security department officers parked outside his house and, “were hovering
about, watching for any sign of tension or break in routine…[t]hey made no attempt at
concealment since visibility was part of their game: crank up the pressure, see if he
panics.”331
Increased control over the rank-and-file PIRA volunteers permitted the
organization to reach a level of compartmentalization that produced numerous
counterintelligence benefits. After compartmentalizing the PIRA, the average member’s
knowledge of the organization’s plans and personnel became severely limited.332
Raymond Gilmour recalled that his ASU leader did the mission planning while ASU
volunteers would typically learn about the operation only a short time before it was to
take place.333 Another benefit of compartmentalization was that information about PIRA
arms caches was more limited.334 Even if the British could find an informant who knew
where an arms cache was, that informant wouldn’t have known how or by whom the
328 Bishop and Mallie, 320. 329 Ibid, 321. 330 Ibid, 322. 331 Gilmour, 279. 332 Bishop and Mallie, 256. 333 Gilmour, 105. 334 Bishop and Mallie, 256.
110
arms were delivered.335 Compartmentalization also allowed the PIRA leaders to
investigate leaks and informant activity more easily—the list of suspects with access to
particular compartments was small so moles had less room to maneuver.336
With increased control, the PIRA leadership was able to standardize and oversee
counterintelligence training for its recruits. Counter-interrogation training was a primary
focus. The ‘Green Book’ exposes recruits to many British interrogation tactics, including
the use of verbal and physical abuse to ‘soften up’ captors and the “top secret file”
technique, wherein interrogators tried to convince their detainee that they already had a
complete file of all their crimes and activities.337 Gilmour was trained to dump his
weapon, dump his getaway car, change his clothes, and give his clothes a good wash to
“get rid of forensics” following every operation.338 Gilmour was also taught to say
nothing during interrogation and remember the interrogators questions for his PIRA
counterintelligence debriefing following his release.339 By 1977, the RUC became aware
that the PIRA was training its members in counter-interrogation techniques and
detectives at Castlereagh alleged that they had recovered documents and tapes to prove it,
including notes of debriefings by PIRA intelligence officers.340 One of the techniques the
PIRA volunteer would employ was naming the interrogation tactic being used by his
British questioner—a technique that psychologically empowered the PIRA volunteer and
335 Taylor (1997), 288. 336 Taylor (1980), 206 & Urban, 120. 337 The PIRA’s Green Book 338 Gilmour, 99. 339 Ibid, 100. 340 Taylor (1980), 155, 223 & Geraghty, 83.
111
frustrated British interrogators, as many interrogators didn’t even know the names of the
techniques they were using.341
The PIRA’s operational procedures in this time period reflected better
counterintelligence training and awareness. ASUs would pick up weapons, disguises,
and vehicles at safe houses prior to an operation and then drop them at ‘wash houses’
following the operation, where volunteers would also get debriefed and then burn or wash
their clothes to remove forensic evidence.342 During operations, ASUs would work in
code, using the jargon of taxi drivers to avoid getting ensnared in the RUC's electronic
surveillance nets.343 ASUs would mask the identity of their vehicles by changing license
plates to match those of ‘real’ vehicles registered in another county or region.344
Following operations, volunteers were taught to act discretely, to not brag about
operations, and avoid getting drunk.345
The PIRA also began to develop an impressive counter-forensics capability.
Collecting information from volunteers that were captured and put on trial, PIRA forensic
experts were able to put together a 9000 page document on avoiding detection.346 The
document details the RUC’s formidable forensic capabilities, describes how the RUC will
commonly take fibers from washing machines and waste from water pipes in suspected
wash houses, and notes that volunteers should wear nylon or denim rather than wool
341 McFate, 252. 342 Feldman, 44. 343 Bishop and Mallie, 323. 344 O’Brien, 214, 277. 345 The PIRA’s Green Book. 346 Geraghty, 83.
112
clothing since wool sheds fibers easily and readily retains fibers from other materials.347
Perhaps the PIRA’s most sophisticated counter-forensic operation involved concealing a
bomb in a car taken into the Northern Ireland forensics laboratory—the ‘trojan horse’ car
was then remotely detonated, destroying much of the forensic evidence held in the RUC
laboratory.348 PIRA ASUs began using ‘drogue’ bombs in the late-1980s, which would
first punch a hole through an armored vehicle and then detonated a second explosive to
destroy any forensic evidence left on the bomb.349 In instances where forensic evidence
was believed to be successfully destroyed, the PIRA would sometimes falsely announce
the death of a high-value member, which would allow them to ‘resurrect’ that member
for special operations.350
The PIRA continued to use population support in this period for a
counterintelligence advantage. The British SAS found it extremely difficult to operate
clandestinely against the PIRA in areas like South Armagh because locals paid close
attention to outsiders and suspicious behavior.351 Gilmour, a member of a Derry-based
PIRA unit, reported that any strange individual hanging out in a local pub would be
watched closely, chased out, or possible detained and interrogated.352 Anti-British
sentiments in PIRA strongholds were so strong that British soldiers would not risk
directly challenging an attack on an RUC or Army base in these areas, which allowed
347 Geraghty, 84-87. 348 Ibid, 90. 349 O’Brien, 155. 350 Jackson et al (2005), 133. 351 Taylor (1997), 268. 352 Gilmour, 105.
113
ASU’s to escape undetected after an operation.353 Keeping the Army and RUC on
constant alert and under heavy fortification limited their intelligence collection and
offensive operations against the PIRA in these strongholds.354 Population support also
facilitated PIRA investigations of informants. The PIRA used ‘snitches’ to keep tabs on
how much money locals had in their shops, who was relocating to certain areas, and
which women were spending time with British soldiers.355 In the early 1980’s locals
would provide support for high-level meetings by scanning police frequencies to alert
leaders to threatening police activities.356
Aggressive interrogations and investigations of informants also increased in the
third period. Following a failed mission or operational surprise, the PIRA assumed that
someone had betrayed the organization.357 By one estimate, seventy percent of all
informants caught by the PIRA during the entire troubles were executed after 1977.358
Analysis of recovered informant bodies, such as that of British agent Robert Nairac,
suggests that in some cases informants were tortured before being executed.359 Former
PIRA volunteer Sean O’Callaghan reported that investigations of informants sometimes
entailed passing them false information and then monitoring the police reaction.360
Compartmentation made investigations of ‘leaked’ operations even easier as the list of
353 O’Brien, 207. 354 Ibid, 263. 355 Gilmour, 230. 356 Dewar, 127. 357 Bell (2000), 250. 358 Maloney, 155. 359 Coogan, , 265. 360 O’Callaghan, 200.
114
volunteers with access to pre-operational information about a subsequently compromised
mission was usually very small.361
When the PIRA discovered that an informant had penetrated its organization, it
acted to limit the damage the informant could cause. When the British supergrass
informants threatened to cause serious damage in the early 1980s, the PIRA
communicated to the supergrasses through their families that if they retracted their
testimony they would be granted amnesty.362 The PIRA also sent ‘solicitors’ to meet
with arrested PIRA volunteers, under the ruse of providing legal advice, to assess how
much the prisoner had told interrogators and how likely it was he that would break under
additional interrogation—because the ‘defending lawyer’ was entitled to see everything
the prisoner had told interrogators, he could ascertain which volunteers had been
compromised.363
The PIRA also demonstrated a limited capability to manipulate British security
force intelligence operations. Using the aforementioned technical surveillance
equipment, the PIRA discovered key RUC strengths and weaknesses by running
operations and watching the RUC's operational responses.364 In another example, former
PIRA volunteer Stephen Lambert recalled being pitched by a member of the security
forces, and then subsequently working with PIRA leadership to clandestinely tape future
meetings with the British agent to get information about British informant recruitment
361 Maloney, 316. 362 Coogan (1996), 277. 363 Gilmour, 322. 364 Bell (2000), 246.
115
procedures.365 Also, on at least on one occasion, the PIRA used a false report of a break-
in to lure RUC units into an ambush.366
During the 1976-94 period, the PIRA improved its prison counterintelligence
practices. PIRA prisoners were strictly prohibited from speaking to non-PIRA prisoners
and each floor would designate one member to speak with prison officials.367 New
prisoners would be debriefed or interrogated to prevent the British from ‘planting’
informants in their prison community.368 Some PIRA prisoners taught each other a
variation on Irish Gaelic, known as jailic, so that they could converse openly without
being understood.369 PIRA prison leadership in some instances controlled the
intelligence acquired by the rank-and-file prisoners. One PIRA prisoner recalled that
they would get a Sunday paper with complete pages taken out by their own PIRA staff.370
In spite of its counterintelligence advances, the PIRA experienced its fair share of
counterintelligence setbacks. Firstly, compartmentalization was not adopted
comprehensively throughout the organization, which the British supergrass informants
made painfully obvious when they gave evidence against former colleagues in court.371
During the Hunger Strike in the early 1980s, volunteers that had once strictly observed
365 Taylor (1997), 295. 366 Bell (1997), 488. 367 Gilmour, 216. 368 Ibid, 216. 369 Clarke, 80. 370 Richard English, Armed Struggle: The History of the IRA (Oxford University Press: New York, 2003), 230. 371 Taylor (1997), 211.
116
non-fraternization rules openly attended marches and conversed with other volunteers in
public, overcome by the emotion of the day.372
Secondly, centralization generally made the PIRA less vulnerable to informants
among the rank-and-file but generally more vulnerable to informants in high-level or
sensitive positions. The RUC’s Special Branch and British army intelligence had long
identified the PIRA’s security department as a leading target for infiltration.373 Because
the security department was privy to many ‘compartmented’ programs, an informant in
the department would be able to pass valuable information about PIRA personnel and
plans.374 Moreover, the security department was the vetting and counterespionage shop
for the PIRA, so a well-positioned informant could more easily redirect, terminate or
otherwise manipulate an investigation to exonerate himself. Centralization also allowed
the British to concentrate their resources against key high-value operatives and leaders,
instead of dispersing resources against hundreds of equally low-value targets.375
Thirdly, standardization of intelligence and counterintelligence procedures made
the PIRA more predicable to British security forces. Prior to reorganization, each area of
Northern Ireland had its own training camps and procedures. After reorganization,
British forces could better assess PIRA standard operating procedures by surveilling a
single camp.376 Ultimately, this reveals the key counterintelligence tradeoff that comes
with centralization—centralization allows a group to establish uniform, high-quality
372 Taylor (1997), 257. 373 Maloney, 335. 374 Ibid, 155. 375 Smith, 188. 376 Maloney, 160.
117
tradecraft that is, once cracked by the adversary, significantly more transparent and
predictable.
Finally, the PIRA’s culture of counterintelligence could stifle the organization at
times. Following high-profile British counter-terrorism operations, the PIRA would stall
operations in order to conduct investigations to discover informants.377
Counterintelligence proved to be a good strategy for preserving leaders and talent, but
militated against a high operational tempo.
Summary. The PIRA’s resources, controlled territory and adversary’s capabilities
stayed constant in this period. The PIRA’s organizational structure tightened
significantly in direct response to the British Government’s counterterrorism
improvements. While the PIRA was able to reduce the steady flow of information to
British security forces through superior training and compartmentation, the group also
suffered from several devastating high-level penetrations. The PIRA’s popular support
campaigns also routinely exposed critical information about the group’s personnel and
plans.
Hypotheses Revisited
Hypothesis 1(A): With a relatively tighter command and control structure the
PIRA will have superior counterintelligence training and compartmentation. This is
correct. The PIRA was able to standardize counter-interrogation and general
counterintelligence training as a result of tightening up command and control structures.
There is some evidence that PIRA volunteers were better prepared to resist interrogation
377 O’Brien, 143.
118
as a result of this training. The PIRA volunteers’ increased attention to counter-forensic
techniques also reflects the benefits of improved training. Additionally, British
infiltrations of PIRA ASUs by the late 1970s provided the British with more limited
picture of PIRA activities on the whole as a direct result of compartmentation.
Hypothesis 1(B): With a relatively tighter command and control structure the
PIRA will be more vulnerable to its adversary’s efforts to develop high-level penetrations
and exploit the group’s standardized counterintelligence procedures. The PIRA case
strongly supports this hypothesis. British infiltration of sensitive cells in the late 1970s,
such as the security department, provided British forces with a volume of information on
the PIRA that they could not have acquired with their best penetrations of the early
1970s. The PIRA’s standardization of training, for example, allowed the British to glean
more about the PIRA through infiltrating a single camp than it could in the early 1970s.
There is no evidence, however, that directly demonstrates a link between improved
British counterterrorism operations and British knowledge or exploitation of PIRA
counterintelligence standard operating procedures.
Hypothesis 2(A): With relatively greater popular support the PIRA will have
greater counterintelligence support from the local population. Though the PIRA case
did not provide an opportunity to contrast periods of high and low popular support, the
PIRA’s experience of high popular support is consistent with the hypothesis. The PIRA
received crucial counterintelligence support from its Hen Patrols, who were members of
the community that alerted Republicans to incoming British patrols and raids. The PIRA
119
also capitalized on its popular support as members of the community volunteered vital
human and technical intelligence to the group.
Hypothesis 2(B): With relatively greater popular support the PIRA will be more
likely to expose itself in its efforts to maintain popular support. The PIRA’s experience
of high popular support is consistent with the hypothesis. The PIRA routinely exposed
its personnel and plans at PIRA marches, rallies and pubs, despite non-fraternization rules
banning the mingling of known and unknown PIRA members.
Hypothesis 3(A): With relatively more controlled territory the PIRA will have
superior communications security, physical security and counterintelligence vetting.
Though the PIRA case did not provide an opportunity to contrast periods of high and low
controlled territory, the counterintelligence gains enjoyed by PIRA in its controlled
territories is consistent with the hypothesis. The PIRA’s controlled territories allowed the
group to more effectively train its members and coordinate its operations while analyzing
their counterintelligence strengths and weaknesses.
Hypothesis 3(B): With relatively more controlled territory the PIRA will be more
vulnerable to its adversary’s efforts to track the group’s gross financial, logistical and
personnel movements. The counterintelligence deficits incurred by PIRA in its controlled
territories is mostly consistent with the hypothesis. British security forces were
consistently able to produce intelligence from close observation of areas of high PIRA
member concentration. Checkpoints and surveillance cameras near urban controlled
territories allowed known PIRA members to be tracked and suspected PIRA members to
120
be monitored for connections to confirmed PIRA entities. Security towers in the PIRA’s
rural controlled territories offered the British a similar surveillance advantage.
Hypothesis 4: The PIRA will become increasing centralized and tightly
commanded over time in the face of external threats. The PIRA case supports this
hypothesis. The PIRA leadership recognized explicitly in the ‘Staff Report’ and the
Green Book that British counterterrorism capabilities had to be met with improved
counterintelligence tradecraft. The PIRA deemed it essential to its survival to become
more effective in counter-interrogation techniques, vetting new members, conducting
investigations of suspected informants, lowering the operational profiles of members, and
countering forensic innovations adopted by the British government. If the PIRA had not
adapted so effectively it probably would have been incapacitated, if not completely
eliminated, by the end of the 1970s.
Control Variables: Alternative Explanations Review
As discussed earlier, the control variables do not remain perfectly constant in the
PIRA case study, opening up the possibility that the control variables account for some of
the change in the dependent variables. First, the British Government’s counterterrorism
capabilities increased in Period Two. Thus, the dramatic improvements in the PIRA’s
counterintelligence capabilities from Periods Two to Three, hypothesized to result from a
change in the group’s organizational structure, may be exaggerated by the initial shock of
the adversary’s increased capabilities in Period Two. Perhaps the PIRA would have
naturally recovered from this shock to develop more capable and sophisticated
counterintelligence procedures in response, regardless of organizational structure. While
121
this explanation seems plausible, it is important to note that many PIRA
counterintelligence innovations, such as standardization and compartmentation, were
only possible with a tightened structure.
The increasing British capabilities could also account for counterintelligence
deficits hypothesized to have been associated with the group’s popular support and
controlled territory. Period One, however, provided a good control for these effects as
PIRA counterintelligence deficits associated with popular support and controlled territory
were present in Period One when British capabilities were low and Period Two when
British capabilities were high.
The PIRA’s resources are essentially held constant over all three periods,
reducing the likelihood that shifts in resources are accounting for the changes in
counterintelligence strengths and vulnerabilities. However, the PIRA did recruit higher
quality personnel in the late 1970’s relative to the early 1970’s. Thus, the PIRA
increased counterintelligence capabilities could have resulted from recruiting and
developing higher quality personnel. This is probably true to a certain extent and British
intelligence made this assessment in 1978: “The active service units are for the most part
manned by terrorist with up to 10 years of operational experience…[t]he mature
terrorists, including for instance the leading bomb makers, are usually sufficiently
cunning to avoid arrest.”378 Though the PIRA might have occasionally been recruiting
more talented individuals, it was the reorganization and standardization of training that
permitted the PIRA to develop and coordinate the activities of more talented individuals.
378 Coogan (1996).
122
Additionally, the counterintelligence advantages gained through the compartmentation of
cells had little or nothing to do with the talents of the individuals making up those cells.
The PIRA undoubtedly experienced normal organizational learning over the three
periods. While organizational learning can account for some improvements in PIRA
counterintelligence procedures, the most important improvements resulted directly from a
tightening of the group’s organizational structure. As explained above, the ability to train
group members, coordinate counterintelligence operations, and compartment group cells
are innovations that require a tight organizational structure.
Lessons from the PIRA Case Study
The PIRA case study provides support for several hypotheses, suggests interesting
twists on several hypotheses, and provides insight into potential interactions between the
independent variables and between the intelligence and counterintelligence variables.
First, tightening a terrorist group’s structure provides both counterintelligence
advantages and disadvantages. Tightening allows a group to provide better
counterintelligence training and direction to compartmented cells. Tightening also
increases the adversary’s ability to predict organization’s standard operating procedures
and counterintelligence tradecraft, making the organization more vulnerable to adversary
surveillance and penetration. Compartmentation makes the group less vulnerable to low-
level infiltration, but the tight structures required for effective compartmentation with
control makes the organization more vulnerable to high-level penetrations. Tightening
allows the group to better vet and control operations in order to maintain the population’s
support—for instance by mandating that civilians not be targeted in terrorist group
123
operations. Conversely, tightening and compartmentation can reduce popular support by
giving the terrorist organization’s community leaders and civic activities a lower public
profile.
Second, the case suggests that the quality of a terrorist group’s intelligence
apparatus can directly affect the quality of its counterintelligence capabilities. If a
terrorist group has intelligence on what its population desires and on its adversaries
vulnerabilities, then it can select targets and conduct operations that achieve its
population’s objectives. With better operations the terrorist group will increase its
popular support, which will reduce the adversary’s ability to stage aggressive military,
policing and intelligence operations against the terrorist group. Additionally, a terrorist
group that performs better operations and garners high population support will produce
fewer disaffected and disillusioned members that are vulnerable to the adversary’s
recruitment pitches.
Third, prisons can play an important role in the quality of a terrorist group’s
intelligence capabilities. For the PIRA, prison sentences were sometimes a great benefit
for the organization as the jail time allowed volunteers to ponder PIRA strategy and
tactics face to face with other volunteers, without the fear of being arrested.
Fourth, centralization may affect how quickly a terrorist group’s capabilities can
evolve as its adversary’s counterterrorism capabilities evolve. As stated earlier, the
terrorist group and its state adversary are often engaged in a competitive and dynamic
relationship—a move or innovation by a terrorist group will frequently result in a
countermove or counter-innovation by the state adversary, and vice versa.
124
Terrorist groups that can initiate intelligence and counterintelligence innovations, as
opposed to simply reacting and adapting to the adversary’s innovations, will be better
positioned to take advantage of its adversary’s vulnerabilities. It stands to reason that
centralized organizations would be uniquely capable of transmitting lessons learned to
the whole organization and thereby increasing the organization's overall capacity for
innovation.
125
CHAPTER THREE: FATAH AND BLACK SEPTEMBER
The Palestinian terrorist group Fatah used territory it controlled in the 1960s to
recruit and train its personnel and to launch attacks against Israel, its main adversary.379
In the early 1970’s, Fatah sent terrorist operatives into ‘uncontrolled territory’ across
Europe, Asia and the Middle East to attack Israeli interests abroad. Israel answered by
dispatching assassination squads throughout these regions to hunt down Fatah’s
international leaders, many of whom were successfully tracked down and killed. While
Fatah had adapted to the challenges and advantages of their controlled territory, the
uncontrolled territory of Europe and the Middle East offered an entirely new set of
challenges.
The case will show that Fatah leveraged the critical counterintelligence
advantages of operating outside of its controlled territory.380 The case will also show that
despite these advantages, Fatah leaders were often more secure within Fatah’s controlled
territory as they could insulated themselves with multiple layers of personal security
among tightly-knit communities. The Fatah case study provides a good test of
Hypotheses 3(A) and 3(B). While the large-N data set provided support to the
379 As described in Chapter One, controlled territory is defined as a geographical space where a terrorist group regulates physical access to and security within defined territorial boundaries. Controlled territory can be acquired either from a state sponsor granting a terrorist group freedom of movement within its borders or from a weak government that does not have the resources or the will to challenge the terrorist group’s physical control of the territory. Geographical space is defined, at a minimum, as a large neighborhood or collection of neighborhoods. 380 Operating ‘outside of or without controlled territory’ occurs when the terrorist group’s operatives live, plan operations or carry out a significant portion of operational acts in a geographical space to which they do not regulate physical access.
126
hypothesis, the case study permits close evaluation of the causal mechanisms linking
controlled territory and the hypothesized counterintelligence outcomes.
In this chapter, I first provide a discussion of the key hypotheses and alternative
hypotheses, and then the Fatah case study. Following the case study, I review the
hypotheses and provide a general assessment of how a group’s controlled territory
impacts its counterintelligence capabilities.381
The Fatah case study is broken into three parts. The first part depicts Fatah when
it operated without controlled territory and minimal popular support in the West Bank
and Gaza Strip between 1965 and 1967. The second part depicts Fatah when it operated
within its controlled territory with high popular support in Jordan and Lebanon between
1967 and 1982. The third part depicts a smaller core of Fatah members, also known as
the Black September Organization (BSO), operating outside of Fatah’s controlled
territory in Lebanon, dispersed among the Palestinian diaspora communities of Europe
from 1971 to 1978. The three parts will illustrate how Fatah’s counterintelligence
strengths and vulnerabilities changed depending on whether it was operating in its
controlled territory.
Fatah Case Study Core Hypotheses
Hypothesis 1(A): With a relatively tighter command and control structure Fatah
will have superior counterintelligence training and compartmentation.
381 It is important to note that control of territory and popular support are closely associated. Therefore, popular support will be given special attention in order to isolate the effects of access to controlled territory and popular support.
127
Hypothesis 1(B): With a relatively tighter command and control structure Fatah
will be more vulnerable to its adversary’s efforts to develop high-level penetrations and
exploit the group’s standardized counterintelligence procedures.
Hypothesis 2(A): With relatively greater popular support Fatah will have greater
counterintelligence support from the local population.
Hypothesis 2(B): With relatively greater popular support Fatah will be more likely
to expose itself in its efforts to maintain popular support.
Hypothesis 3(A): With relatively more controlled territory Fatah will have
superior communications security, physical security and counterintelligence vetting.
Hypothesis 3(B): With relatively more controlled territory Fatah will be more
vulnerable to its adversary’s efforts to track the group’s gross financial, logistical and
personnel movements.
Hypothesis 4: Fatah will become increasing centralized and tightly commanded
over time in the face of external threats.
Alternative and Falsifiable Hypotheses
The alternative hypotheses argue the opposite of the core hypotheses. Thus, the
first alternative hypothesis is that tighter organizational structure will not produce
superior counterintelligence training and compartmentation or greater vulnerabilities to
high-level penetrations. Conversely, if the group has a loose organizational structure but
does not suffer from inferior counterintelligence training and compartmentation, then the
alternative hypothesis is correct and the core hypothesis is falsified.
128
The second alternative hypothesis is that popular support will not result in greater
counterintelligence support from the local population or greater vulnerability to exposure
in the media. Thus, if the group wages a popular support campaign but does not induce
counterintelligence vulnerabilities as a result and does not benefit from increased local
support, then the alternative hypothesis is correct and the core hypothesis is falsified.
The third alternative hypothesis is that controlled territory will not result in
greater physical and communications security or greater vulnerabilities to tracking the
group’s gross movements of personnel and logistics. Thus, if the group operates from
controlled territory but does not benefit from more secure communications and vetting,
then the alternative hypothesis is correct and the core hypothesis is falsified.
The fourth alternative hypothesis is that a terrorist group facing an increasing
menacing adversary will not become more centralized and tightly commanded over time.
Thus, if the group faces an increasing threat from its adversary but does not centralize its
decision-making and tighten its command and control, then the alternative hypothesis is
correct and the core hypothesis is falsified.
Control Variables: Alternative Explanations
Some control variables do not remain perfectly constant in the Fatah case study,
opening up the possibility that the control variables account for some of the change in the
dependent variables. Fatah’s adversary’s capabilities remain relatively constant in the
three periods and so are unlikely to produce variations in the counterintelligence
capabilities over time. Fatah’s resources, however, fluctuate between the three periods.
Thus, the variation in Fatah’s counterintelligence capabilities could result from
129
differences in its overall size or the quality of its members, rather than from variations in
its controlled territory. For example, Fatah was much larger than the BSO, which would
have increased its operational profile and the group’s exposure to Israeli security
services. BSO operatives were also better-trained then Fatah terrorists on average,
making them more likely to achieve intelligence and counterintelligence success. If
BSO’s small size or superior skills helps it to evade Israeli security forces or recruit
sympathetic diaspora community members, then this would challenge Hypotheses 3(B).
Fatah’s popular support also varied between the three periods and differences
attributed to the variation in controlled territory could have arisen from changes in
Fatah’s popular support between the time periods. Fatah in the 1967 to 1982 period had
more popular support than BSO and spent more time campaigning for support. For
example, BSO spent less time generating popular support and publicizing its
achievements and information about its members. BSO should thus have enjoyed more
counterintelligence successes, as posited by Hypothesis 2(B).
The variation in Fatah’s counterintelligence capabilities could result from
differences between the goals and missions of Fatah between the time periods. For
example, while both Fatah and BSO engaged in sabotage and terrorist operations, BSO
was created to be more secretive and clandestine than Fatah. Whereas Fatah operated
among and interfaced with its popular support base on a regular basis, BSO was able to
fade into the background of its theater of operations. This might account for the
counterintelligence vulnerabilities associated with controlled territory posited by
Hypothesis 3(B). Examining Fatah in 1964 to 1967 period when it operated without
130
controlled territory, but with a mission similar to that of Fatah in the 1967 to 1982 period,
will help to tease out the effects of the groups’ mission and territories.
Finally, Fatah’s counterintelligence strengths in periods two and three may result
from normal organizational learning rather than variation in controlled territory. The
case will need to show, however, that the hypothesized counterintelligence strengths and
innovations resulted from the core variables rather than organizational learning. The case
will do this by illuminating the casual mechanisms driving the counterintelligence
outcomes and demonstrating that despite normal organizational learning, the observed
counterintelligence strengths and innovations would not have occurred without the core
variable shift.
Fatah Case Study: Dependent Variables
Fatah/BSO
Adversary CT
Capability
Org Structure
Resources
Controlled Territory
Popular Support Type
Fatah 1964 - 1967 High High High No Low 2
Fatah 1967 - 1982 High High High Yes High 8
BSO 1971 - 1978 High High High No High 6
Fatah Background
Fatah’s nucleus formed in the late 1950’s among Palestinian students at
universities in Europe and Egypt. The organization’s full name, Tahrir al Hatani al
131
Filistini, as an acronym (HTF) forms the Arabic word for death, and in reverse (FTH)
forms the Arabic word for conquest.382 In the early 1960’s Fatah concentrated on
developing secret cells, collecting funds and distributing Palestinian literature. By 1965
Fatah had launched a more active and violent campaign of terrorist warfare against
Israel.383
Fatah 1964 - 1967
Adversary Counterterrorism Capability. Powerful state adversaries have hounded
Fatah since its inception in the late 1950’s. When Fatah emerged as a political movement
run by Egyptian university students in the late 1950s, and the Egyptian government
moved quickly to deport its leaders.384
In 1965, Fatah based itself in the Gaza Strip and the West Bank, using this
territory to recruit guerrillas and launch operations against Israel. Fatah did not have
control of this territory however, because the group did not regulate physical access to or
movement within defined territorial boundaries in these locations. Israel’s aggressive
policing of the West Bank and Gaza prevented Fatah from controlling the territory.
Israel was able to arrest and imprison many of Fatah’s recruits in the West Bank
and Gaza Strip.385 Using informers in the West Bank and Jordan, Israel infiltrated Fatah
382 Edgar O’Ballance, Arab Guerilla Power: 1967-1972, (Archon Books: London, 1973), 26. 383 Ibid, 26. 384 Ehud Yaari, “Strike Terror: The Story of Fatah,” (Sabra Books, New York: 1970), 22. 385 Said K. Aburish, “Arafat: From Defender to Dictator,” (Bloomsbury: New York. 1998), 74.
132
and disrupted its operations as they were being planned.386 Israel’s swift retaliation made
many would-be Fatah recruits reluctant to join the terrorist organization.387
In addition to collecting information from informants, Israel broke up newly
formed Fatah cells and kept abreast of the political mood of the population.388 Israel’s
retaliation involved demolitions of Palestinian houses, curfews, and restrictions on
movements, all of which caused the Palestinian population to distance itself from Fatah
terrorists.389 Palestinians became reluctant to pass on information or provide food or
shelter to Fatah fighters.390
In the Six Day War of June 1967, Israel fought Egypt, Syria, Iraq and Jordan and
ultimately seized the Gaza Strip, West Bank, Sinai Peninsula and the Golan Heights.
Israel was able to capture the Jordanian army intelligence branch’s files of all the
fedayeen and sympathizers in the West Bank, along with their detailed histories and
photographs.391
Despite Israel’s control over the Gaza and West Bank territories, Fatah continued
its terrorist operations. In the latter part of 1967, Fatah organized sixty-one military
operations in the West Bank, mostly against civilian targets such as farms, apartment
buildings and factories.392 By November 1967, however, the majority of Fatah personnel
386 Ibid. / Yaari, 141. 387 Aburish, 74. 388 Zeev Schiff and Raphael Rothstein, Fedayeen: Guerrillas Against Israel, (David McKay and Company, Inc: New York, 1972), 77. 389 O’Ballance, 40. 390 Ibid, 40. 391 John K. Cooley, Green March, Black September, (Frank Cass: London, 1973), 98. 392 Rubin, 39.
133
in the West Bank had been killed, captured, or driven into Jordan.393 By 1968, Israeli
security patrols kept the border between Jordan and the West Bank virtually sealed off
and carefully scrutinized all militants organizing in the West Bank and the Gaza Strip.394
As a result, Fatah had limited manpower—by one estimate Fatah had no more than 100
fighters.395
Controlled Territory. Fatah, as explained above, did not have controlled territory
in the 1964 to 1967 period. Fatah did use a small number of refugee camps for training
and recruiting. In 1964, Fatah took advantage of the Lebanon’s weak central government
and set up training sites near Palestinian refugee camps in Lebanon.396 The overcrowded
camps of the Gaza Strip provided Fatah terrorists with some limited cover and sanctuary
while they launched attacks against Israel.397
Israel policed the West Bank and Gaza Strip aggressively and moved forcefully to
challenge Fatah guerrillas, which eventually forced Fatah to relocate to Jordan.
Organizational Structure. In the 1964 to 1982 period, Fatah’s organizational
structure was mostly tight, with leaders exercising a relatively high degree of command
and control over the organization. When Fatah operated predominantly out of the West
Bank in the mid-1960s, terrorist cells were often cut-off from Fatah’s top leaders based in
Syria.398 Fatah leaders, as a result, imposed strict regulations on cells for choosing
393 O’Ballance, 40. 394 Schiff and Rothstein, 85. 395 Yaari, 109. 396 Aburish, 60. 397 Schiff and Rothstein, 86. 398 Yaari, 77.
134
targets and methods of attack.399 The leadership in Syria and cells in the West Bank
would communicate through couriers and liaisons when they had the opportunity.400
Fatah’s control over its cells was due in part to the force of Yasser Arafat’s
charismatic leadership. Arafat was personally organizing underground networks,
coordinating and mediating between various units, and determining their objectives by
intermittently shuttling between the West Bank and Damascus.401 Arafat contacted
almost all units and many captured terrorists could tell stories about him.402 Though Fatah
had a mostly tight organizational structure, Fatah faced some organizational discipline
challenges during its time in the West Bank. Some terrorists, for example, joined Fatah
without being efficiently coordinated or supervised by senior members.403
Popular Support. Though Fatah’s popular support was high for much of its
existance, its support was relatively low during 1964 to 1967 period in the West Bank. In
1964, Fatah created a political base from the Palestinian intelligentsia and enjoyed some
support in the refugee camps of the West Bank and Gaza—though not as much as it
would gain after 1967.404 Fatah’s West Bank command set up its headquarters in Nablus
and used sympathetic local physicians to treat wounded terrorists.405 Unrest in
399 Yaari, 77. 400 Ibid, 107. 401 Ibid, 128. / Kurz, 48. 402 Ibid, 128. 403 Ibid, 131. 404 El-Rayyes and Nahas, 8. 405 Yaari, 130.
135
Palestinian refugee camps, where an estimated 200,000 of the 400,000 refugees lived
under United Nations sponsorship, provided a recruiting pool for Fatah. 406
Fatah also tried tapping into a network of Arab Fatah sympathizers within Israel
who helped carry out acts of sabotage.407 In this period, there were approximately
440,000 Israeli Arabs living in Israel but only a small fraction would end up in Israeli
prisons or detention camps for real or alleged cooperation with Palestinian guerrillas. 408
Many Israeli Arabs did not support Fatah and instead aligned themselves with the Israeli
government or with popular Egyptian leader Gamal Nassar who openly opposed sabotage
activities.409
Several factors impaired Fatah’s ability to gain popular support in the West Bank
between 1964 and 1967. Fatah’s code of secrecy was one factor that interfered with the
group’s effort to gain widespread support.410 Israeli counterinsurgency efforts also
capped the amount of widespread public support Fatah could attain, as villages were
often reluctant to pass information or provide shelter to Fatah terrorists.411 Fear of being
caught and punished by Israel compelled many Palestinian residents to limit their
assistance to Fatah to providing food and advice on local conditions.412 Arafat would
spend a good deal of time escaping Israeli forces, which were being aided by Palestinian
406 Schiff and Rothstein, 86. / Ibid, 204. 407 Cooley, 109. 408 John Laffin, “Fedayeen: The Arab-Israeli Dilemma,” (Cassell: London, 1973), 95. / Cooley, 109. 409 Yaari, 111. 410 Yaari, 74. 411 O’Ballance, 40. 412 Schiff and Rothstein, 203.
136
informants.413 By the late 1960s, it was clear to Fatah that the local population was not
receptive to a popular uprising against Israel.414
Resources. During Fatah’s initial campaign in the West Bank, it drew upon
recruits gathered in the refugee camps of Lebanon and among men accustomed to hiring
themselves out to Arab intelligence services.415 Recruits were trained in terrorist
techniques based on Algerian and Vietnamese programs of unconventional warfare.416
Recruits were trained on Kalashnikov riffles and indoctrinated in Palestinian and Arab
history as well as Fatah’s philosophy.417 In late 1967, Fatah organized sixty-one military
operations in the West Bank, mostly against civilian targets such as farms, apartment
buildings and factories.418
Throughout its existence, Fatah was well-financed. In its early days, members of
the Qatari ruling family as well as wealthy and influential Saudis provided funds to
Fatah.419 As it grew, Fatah began to receive donations from other Arab governments and
remittances from Palestinians working throughout the world. In Lebanon, Fatah forced
some Lebanese businesses to pay protection fees, while some Fatah members ran illicit
arms and drugs networks.420
Intelligence. Fatah’s intelligence capabilities were fairly basic during 1964 to
1967 period. Target surveillance was a staple of the Fatah operations. As early as 1964,
413 Rubin, 39. 414 Ibid, 203. 415 Schiff and Rothstein, 62. 416 Aburish, 60. 417 Ibid, 60. 418 Rubin, 39. 419 Walker, 37. 420 Rubin, 58.
137
Fatah was running reconnaissance missions into Israel to gather intelligence for sabotage
operations.421 In the first three months of 1965, Fatah carried out ten sabotage operations
in Israel using terrorists recruited for each operation by liaison men in the West Bank and
Gaza.422 Before Arafat relocated to the West Bank, couriers shuttled intelligence to him
in Damascus from Fatah cells in Beirut and the refugee camps.423
Syrian intelligence training, by 1965, had made a noticeable impact on Fatah
intelligence capabilities—intelligence units became more efficient and better able to
provide information on targets and approach roads.424
The “Minimanual of the Urban Terrorist”, which Israeli-Arab expert Steve Posner
claims was required reading for Fatah and PLO recruits, counsels terrorists to take
personal responsibility for gathering intelligence against the adversary: “The urban
terrorist must have a great ability for observation…he must be well-informed about…the
area in which he lives, operates, or travels through.”425 The Minimanual notes that local
populations that oppose the government and its security forces will be an excellent source
of information.426
In the mid-1960s Fatah tried to establish ‘village cells’, modeled after the Viet
Cong intelligence system, to provide such information on Israeli security forces.427 Fatah
421 Yaari, 43. 422 Ibid, 66. 423 Ibid, 69. 424 Ibid, 78. 425 Carlos Marighella, “The Minimanual of the Urban Terrorist,” accessed on 22 August 2006 at http://www.marxists.org/archive/marighella-carlos/1969/06/minimanual-urban-terrorist/index.htm. 426 Marighella. 427 O’Ballance, 39.
138
recruited some of the Israeli Arabs living inside of Israel but the Israeli internal security
services were effective at monitoring these populations and at limiting the support that
Fatah gained.428 A small network of Fatah informants allegedly operated in Israel in
1967 and passed intelligence on potential targets to Fatah liaison men waiting in
Jordan.429
Counterintelligence: 1964 – 1967. Fatah’s counterintelligence capabilities had
varying sophistication in the 1964 to 1967 period, though counterintelligence and security
probably were always a central focus for the group. Even before Fatah was formed,
Arafat was learning how to evade Arab intelligence services by compartmenting his
small, radical student organization in Kuwait.430
When Fatah formed in the early 1960s, the group concentrated on developing
secret, compartmented cells that would distribute pro-Palestinian literature.431 From the
beginning, Fatah leaders adopted aliases.432 Arafat’s alias was Abu Amar and Fatah itself
was given an alias, al Assifa (the Storm).433 Fatah’s leaders reasoned that the group alias
would allow Fatah to avoid embarrassment and continue with secret military and
propaganda operations if its initial attacks failed.434 At this early stage, Arafat chose not
to reveal his identity in order to maintain his safety.435 Fatah’s security consciousness
428 Yaari, 111. 429 Ibid, 111. 430 Aburish, 47. / Yaari, 10. 431 O’Ballance, 26. 432 Yaari, 127. 433 O’Ballance, 28. 434 Cooley, 95. 435 Ibid, 97.
139
was reinvigorated in the first few months of 1965 in the wake of several
counterintelligence lapses and betrayals.436
Fatah leaders took numerous precautions in vetting new members. Potential
recruits had to be recommended by two or three active members.437 Recruits also had to
demonstrate that they had severed ties with Arab political parties, probably to prevent
infiltrations by Arab intelligence services. They were interviewed at length and then had
to take an oath of allegiance, wherein they promised not to give away Fatah’s secrets.438
One Fatah member recalled: “We kept our secrets so close that the word Fatah would not
be mentioned except to a member. Only Fatah members could see our two basic
documents, the organizational structure and the political program.”439
Fatah was occasionally burned in this early period by bad counterintelligence
practices. One of these setbacks involved Fatah’s habit of cataloguing lists of members
and operational details. In May 1966, a Jordanian-informant in Fatah’s ranks fled to
Jordan with a list of Fatah’s members, details the organization, their leaders and
operational plans.440 Many of Fatah’s cells in the West Bank were rolled up soon
thereafter. The Jordanians also used the compromised information to broadcast fake code
signals calling terrorists in Syria to Jordan, where the Jordanian security forces
subsequently captured the terrorists at the border with their weapons.441 The Israelis were
436 O’Ballance, 29. 437 Walker, 24. 438 Walker, 24. 439 Ibid, 24. 440 Yaari, 88. 441 Ibid, 88.
140
also able to defeat Fatah in the West Bank quickly because they developed good
intelligence sources among the local Palestinians.442
Fatah also had its share of counterintelligence innovations in this early period,
such as its use of throw-away aliases. Fatah coordinators assembled cell members for
operations in an ad hoc manner and issued members one-time aliases for the operation,
which would change for their next mission.443 Fatah also established a formal
counterespionage capability. Counterespionage personnel focused on capturing Arabs
suspected of cooperating with Israeli security forces in the refugee camps.444 Arafat also
developed sophisticated personal security procedures, using several go-between security
officers to vet any group member that requested an audience with him.445 Arafat relied
on messengers and couriers and allegedly never used the telephone or telegraph.446 Fatah
in some cases communicated with its rank and file by sending coded signals via its Cairo
Radio station, which broadcast to Egypt, Jordan and Syria.447
Fatah faced a serious counterintelligence setback in August 1967 when Israeli
forces advancing into the Jordanian controlled West Bank seized Jordanian intelligence
and police files on Fatah.448 The intelligence files included detailed histories and mug
shots of many Fatah terrorists.449 Israeli security forces used the information to capture
442 Rubin, 39. 443 Ibid, 107. 444 Schiff and Rothstein, 86. 445 Yaari, 128. 446 Yaari, 128. / Barry Rubin and Judith Colp Rubin, “Yasir Arafat: A Political Biography,” (Oxford University Press: Oxford, 2003), 39. 447 O’Ballance, 60. 448 Ibid, 39. 449 Cooley, 98.
141
Fatah operatives as they tried to reenter the West Bank.450 Israel also conducted a ‘cave’
survey in the West Bank, capturing and interrogating many terrorists.451 Security forces
encircled villages where suspected terrorists were hiding and by January 1968 had almost
completely shut down sabotage operations launched from the Palestinian territories.452
Fatah responded to Israel’s increased intelligence by ferociously hunting down
informants—Israeli figures indicate that terrorists were terrorizing suspected
collaborators as often as they were terrorizing Israelis in the late 1960s.453 Fatah set up a
special counter-espionage unit in this period, called the Jihaz al Razd, which was run by
Arafat’s confidant Saleh Khalef, also known as Abu Iyad.
When the infamous BSO terrorist Ali Hassan Salameh joined Fatah as a young
man in 1967, one of his first assignments was to track down Fatah terrorists who were
working for the Israeli security forces.454 Salameh, working for the Jihaz al Razd, would
scan the file of each new recruit and conduct a background check. Abu Iyad and
Salameh would sometimes test suspected informants by making them undertake
particularly dangerous missions behind Israeli lines to test their loyalty. Salameh would
then threaten to broadcast a tape of the terrorist confessing to being an informant if the
terrorist did not return from the mission.455
450 O’Ballance, 39. 451 Yaari, 143. 452 Ibid, 145. 453 Dobson, 26. 454 Bar-Zohar and Haber, 100. 455 Bar-Zohar and Haber, 100.
142
Only a few terrorists confessed to collaborating with Israel, while many suspected
informants were brutally killed—twenty in Salameh’s first year in the Jihaz.456 Though
Arafat dealt with informants in a heavy-handed fashion, he refrained from punishing
local leaders in the West Bank to avoid a backlash among the prominent tribes and
families in the area.457 Israel, it seems, had more leeway in meting out punishment and
was able to wipe out Fatah’s networks in the West Bank. This is probably due to the fact
that the comfortable, middle-class Palestinians of Nablus, Ramallah and Jerusalem, with
some important exceptions among young people, did not desire to live the life of
clandestine guerrillas.458
Summary. In the first period, Fatah maintained a tight organizational structure
and enjoyed high resources, but had low popular support, no controlled territory and a
very capable adversary. Fatah enjoyed some of counterintelligence advantages of
operating outside of controlled territory, forcing Israel to locate and monitor Fatah
operatives across large swaths of ‘neutral’ territory. However, Fatah’s lack of controlled
territory did not always make it easier for the group to hide its personnel and logistics.
This is partly due to the fact that Fatah remained in territory that was effectively policed
by Israel. Fatah’s popular support also seemed to play a role in its counterintelligence
failures as residents of the West Bank and Gaza Strip feared Israel’s wrath more than
they supported Fatah’s activities.
Fatah Timeline: 1967 - 1982
456 Bar-Zohar and Haber, 100. 457 Aburish, 74. 458 Cooley, 98.
143
Fatah 1967 - 1982
Adversary Counterterrorism Capability. Challenged by Israel’s dominance of the
West Bank and Gaza Strip, Fatah relocated to Jordan and Lebanon by 1968, and returned
to launching operations against Israel.459
Fatah found refuge in Jordan in part because the Jordanian army was still
recovering from the Six Day War and Jordan’s leaders did not want a larger confrontation
with the country’s large pro-Palestinian population. Fatah was able to seize and control
territory in Jordan and the city of Karameh became the centerpiece of its strongholds.
Israel could not infiltrate and police Karameh and other Fatah strongholds in Jordan so
instead Israel mounted large military attacks against these territories. Israel carried out
one of its largest attacks against the Fatah stronghold in Karameh on March 21, 1968.460
Israeli security forces also set up ambushes on frontier paths to catch Fatah militants
traveling to and from the Jordan.461 Though Karameh was a clear tactical victory for
Israel, Fatah post-battle propaganda made the event a huge strategic victory for the
459 Simon Reeve, One Day in September, (Arcade Publishing, New York, 2000), 28. 460 Anat N. Kurz, “Fatah and the Politics of Violence: The Institutionalization of a Popular Struggle,” (Sussex Academic Press: Brighton, 2005), 52. 461 O’Ballance, 57.
1965: Fatah Begins Terror Activity
1968: Israel Chases Fatah out of the West Bank and into Jordan
1968: Battle of Karameh, Jordan
1971: Jordan Routs Fatah -- Fatah Relocates to Lebanon
1972: Israel Invades Fatah Positions in Lebanon
1975: Fatah Comes to Dominate Southern Beirut and Southern Lebanon
1976: Syria Invades Fatah Positions in Lebanon
1978: Israel Re- Invades Fatah Strongholds in Lebanon
144
terrorist group. In Jordan, pro-Fatah posters showing Palestinian guerrillas defeating the
Israeli army filled many shop windows.462
Fatah terrorists also began to battle with Jordanian security services. Jordan’s
King Hussein became increasingly angered as Fatah sought to control large swaths of
Jordanian territory. Though King Hussein offered Fatah guerrillas a truce in 1968,
Fatah’s conflict with Jordan steadily escalated throughout 1969 and 1970.463 Guerrilla
groups proliferated in Jordan during this time, making negotiation between Jordan and
the Palestinian factions very difficult. Furthermore, Arafat had relatively little control
over the estimated fifty-two separate Palestinian factions scattered across Jordan.464
George Habash’s Marxist Popular Front for the Liberation of Palestine (PFLP) further
complicated the picture, calling for revolution against Jordan and its ruling family.465
Jordan finally took decisive action when the PFLP hijacked three planes in 1970,
declaring martial law and demanded the guerrillas leave Jordan’s cities. Arafat
responded by commanding his troops to topple King Hussein.466 Jordan’s army attacked
Palestinian refugee and guerrilla camps, forcing fighter unto the streets where they were
easily gunned down.467 Jordan battled the guerrillas so ruthlessly that some Fatah
fighters were authorized by their commanding officer to seek refuge in Israel rather than
462 Rubin, 46. 463 Ibid, 47. 464 Tony Walker and Andrew Gowers, “Arafat: The Biography,” (Virgin Books: London, 2003), 66. 465 Ibid, 67. 466 Ibid, 51. 467 Ibid, 51.
145
allow themselves to fall into the hands of the Jordanian army.468 The Jordanian army
methodically destroyed Fatah and other fedayeen elements in Jordan.469
Many of Fatah guerrillas retreated to Syria, southern Lebanon, the West Bank or
into the hills of northwest Jordan.470 Jordan’s brutal tactics, including executing terrorists
without trial and mutilating their bodies, began to take a toll on Fatah.471 The Jordanian
army had largely killed, captured or driven Fatah rebels out of the country by the end of
1971.472
In the early 1970s, southern Lebanon became the critical front in the war between
Fatah and Israel. Fatah established a foothold in a small section of Lebanon known as
the Arkoub region, which also became known as Fatahland.473 Fatahland was an area of
approximately 30 square miles in the foothills of Mount Hermon near the borders of
Israel and Syria.474 Following a fedayeen attack on an Israeli school bus in May 1970,
Israel invaded Fatahland with 2,000 troops and 200 tanks. Israel paved roads into the
area so they could set up fortified positions and elevated observation posts.475 This did
not dissuade the Fatah migration to Lebanon. By 1972, over 3,000 Fatah members had
468 Ibid, 80. 469 Brian Crozier (ed), Since Jordan: The Palestinian Fedayeen, Conflict Studies No. 38, September 1973, 6. 470 Ibid, 6. 471 Michael Bar-Zohar and Eitan Haber, The Quest for the Red Prince, (William Morrow and Company, Inc.: New York, 1983), 108. 472 El-Rayyes and Nahas, 22. / O’Ballance, 182. 473 Jullian Becker, The PLO: The Rise and Fall of the Palestine Liberation Organization, (St. Martin’s Press: New York, 1984), 95. 474 O’Ballance, 122. 475 Schiff and Rothstein, 237.
146
settled in Palestinian refugee camps in southern Lebanon, joining the over 200,000
Palestinians that had been in southern Lebanon since 1948.476
Again in 1972, Israel briefly occupied southern Lebanon following the Fatah-led
Munich Olympics massacre.477 Israel used undercover intelligence collectors in Lebanon
throughout the 1970s and 1980s to gather information on Fatah and PLO leadership and
facilities. 478 One well-placed spy provided the Israeli army with the positions of terrorist
targets and photographs of harbors in Lebanese cities of Tyre, Sidon and Ras-a-Shak,
which were subsequently used in Israeli naval raids.479
Israeli security services working in Lebanon tracked terrorists and assisted in
special-forces raids. Israeli services, knowing well the modus operandi of the Lebanese
services, kept the Lebanese authorities from meddling in some Israeli raids. To keep the
Lebanese out of one Israeli raid in 1973, Israeli commandos called the Lebanese police
from various public phones in Beirut falsely claiming that Palestinian factions were
engaged in gun battles—from which Lebanese police kept their distance as the Israelis
had expected.480
476 Schiff and Rothstein, 218. / Richard A. Gabriel, Operation Peace for Galilee: The Israeli-PLO War in Lebanon, (Hill and Wang: New York, 1984), 42. 477 Becker, 100. 478 The Palestinian Liberation Organization (PLO) was created in 1964 to represent Palestinian people throughout the world. The PLO also became an umbrella organization for numerous terrorist groups, including Fatah. Fatah was the largest and most politically influential component of the PLO.478 As head of Fatah, Yassir Arafat also became the head of the PLO in 1969. 479 Steve Posner, Israel Undercover: Secret Warfare and Hidden Diplomacy in the Middle East, (Syracuse University Press: New York, 1987), 47. 480 George Jonas, Vengeance: The True Story of an Israeli Counter-Terrorism Team, (Simon and Schuster Paperbacks: New York, 2005), 185.
147
By 1975, Fatah and the PLO controlled significant portions of southern Beirut,
southern strips of Lebanon, and Palestinian refugee camps. Guerrillas set up roadblocks,
took over buildings, protected fugitives, commandeered vehicles, opened shops and
nightclubs, and issued its own passes and permits.481 Though the Lebanese government
scored numerous victories against Fatah, the group also controlled vast areas of Lebanon
with little challenge.
Israel continued its military incursions into southern Lebanon in the late 1970s
and early 1980s, including a massive invasion in 1982, involving 75,000 Israeli
soldiers.482
Controlled Territory. Fatah’s controlled territory in Jordan from 1967 to 1971
and Lebanon from 1972 to 1984. Fatah was able to regulate physical access to and
security within these large segments of territory. When Fatah was forced to relocate to
Jordan in 1967, Arafat moved his headquarters to Karameh, a large refugee town in the
Southern Jordan Valley.483 Many of the commanders and networks of the West Bank
were moved to Jordan’s East Bank.484 Fatah found fertile recruiting ground among the
450,000 Palestinians living in Jordan.485 By 1968, Fatah membership probably reached
into the thousands.486 At first, Fatah controlled only the refugee camps in Jordan, but
481 Aburish, 151. 482 Aburish, 171. 483 Yaari, 245. 484 Ibid, 245. 485 Schultz and Hammer, 46. 486 O’Ballance, 60.
148
gradually the group began to take over towns and villages close to the border with
Israel.487
When Israel launched its offensive on Karameh most terrorists retreated across
the River Jordan from the East Bank.488 Despite Fatah’s retreat, the Battle of Karameh
was a propaganda success for the organization. The Israeli military withdrew from
Jordan after violent confrontations with Fatah terrorists ended, and Fatah was
subsequently flooded with money and recruits.489 Fatah, overwhelmed by the hundreds
of recruits joining the group, experienced a shortage of instructors, which degraded the
quality of training for at least a year.490 Fatah also moved its headquarters to Es Salt,
outside the range of Israeli commando raids, and set up training camps.491 The Jordanian
government had limited control over the camps but Israel hit Es Salt with air strikes in
August 1968.492 Israeli air strikes were designed to prevent Israeli military losses, boost
domestic morale in Israel, and compel the Jordanian regime to restrict the terrorists’
movements—the policy’s intended effect on Jordan, however, was not immediate.493
King Hussein of Jordan offered a truce to Fatah in November 1968 where Fatah
agreed not to create trouble for Hussein’s regime and Hussein agreed to not restrict the
terrorists’ movements within Jordan.494 Hussein also permitted Fatah to retain their own
487 Bar-Zohar and Haber, 105. 488 O’Ballance, 57. 489 Reeve, 29. 490 Kurz, 55. 491 Schiff and Rothstein, 86. 492 Ibid, 86. 493 Kurz, 52. 494 O’Ballance, 64.
149
travel documents, which were honored by the Jordanian authorities.495 By 1970, Fatah
had achieved a high level of organization in Jordan, administering its own hospitals and
taking care of widows, orphans and the disabled.496 Jordanian authorities estimated that
Fatah commanded approximately 5,000 terrorists in 1971.497
King Hussein, however, became wary of Fatah’s growing influence in Jordan and
its unchallenged control over swaths of Jordanian territory, including the northern areas
of Jerash and Ajloun. Jordanian security forces began to hem in Fatah elements, and
many terrorists chose to flee to Syria and southern Lebanon rather than face off with
Jordanian Bedouin troops.498 By the end of 1971, the Jordanian army had killed or driven
most Fatah members from the country.499
Fatah’s relationship with Lebanon was equally complex. The Lebanese
government had fought terrorist elements to a stalemate in southern Lebanon in
November 1968, which led to the Cairo Agreement in November 1969.500 The
agreement provided the PLO, and by extension Fatah, the right to have a military
presence in the refugee camps in southern Lebanon and the right to provide camp
residents with security.501 In 1972, over 3,000 Fatah members had settled in Palestinian
refugee camps in southern Lebanon.502
495 Ibid, 122. 496 Ibid, 122. 497 Ibid, 170. 498 Reeve, 33. 499 El-Rayyes and Nahas, 22. 500 El-Rayyes and Nahas, 31. 501 Schultz and Hammer, 55. 502 Schiff and Rothstein, 218. / Richard A. Gabriel, Operation Peace for Galilee: The Israeli-PLO War in Lebanon, (Hill and Wang: New York, 1984), 42.
150
Arafat continued to embrace the Cairo Agreement in 1972, realizing that a head-
on clash with the Lebanese forces would severely damage the PLO and Fatah.503 The
Lebanese government tolerated the terrorist presence in Fatahland, mostly because the
Lebanese army was unable to decisively challenge the military power of the PLO.504
The PLO and Fatah gradually assumed administrative control over the Palestinian
camps in Lebanon, running schools and hospitals.505 By 1975, the PLO and Fatah
controlled southern Beirut, southern strips of Lebanon, and Palestinian refugee camps. In
some cases the chain of command became muddled, however, as local militias developed
their own checkpoints, youth movements, and offices.506
Fatah continued to receive support from Syria, though the relationship was
continually rocky. Israeli air raids on Syria in 1972 and 1973 convinced Syria to restrict
the Fatah’s freedom of movement in Syria and Lebanon, in a bid to avoid future Israeli
strikes.507 On June 6, 1982, the Israeli military launched a major ground offensive
against the PLO and Fatah infrastructure in southern Lebanon, and the out-gunned
terrorists abandoned their safehaven.508 With the loss of its controlled territory, Fatah
lost its ability to train members and prepare for battle, educate its youth and recruit them
to the PLO ranks, and protect arms caches—in short, Fatah lost its power base.509
503 O’Ballance, 210. 504 Ibid, 231. 505 Dan Bavly and Eliahu Salpeter, Fire in Beirut: Israel’s War in Lebanon with the PLO, (Stein and Day Publishers: New York, 1984), 38. 506 Becker, 142. 507 Cooley, 131. 508 Kurz, 102. 509 Bavly and Salpeter, 178.
151
Organizational Structure. In the 1964 to 1982 period, Fatah’s organizational
structure was mostly tight, with leaders exercising a relatively high degree of command
and control over the organization.
Arafat maintained control over the Fatah movement even as it shifted its bases
from the West Bank to Jordan and Lebanon. Couriers kept some Damascus-based Fatah
leaders in touch with the organization’s cells throughout Lebanon, allowing Fatah leaders
to direct recruitment campaigns and operation activities carried out from Lebanese
territory.510
Popular Support. When Israel’s counterterrorism efforts forced Fatah to move its
bases from Gaza to Jordan, where the group began building refugee centers, training
camps, schools, clinics and orphanages.511 Eventually, King Hussein of Jordan
recognized that Fatah was building its own state within his kingdom. The King could not
take military action against the group, however, because the Jordanian public was largely
sympathetic to Fatah’s cause.512 Fatah ruled the Palestinian refugee camps, where
Jordanian officials and soldiers were not allowed to enter.513 Fatah’s popularity among
indigenous Jordanians was limited, though, as many resented the Palestinian refugees.514
Fatah’s popularity gained a major boost after the Battle of Karameh. Fatah’s
perceived victory drew 5,000 recruits within 48 hours of the battle.515 Up to this point,
Fatah had maintained secrecy about its organization, origins and membership. After
510 Ibid, 69. 511 Reeve, 30. 512 O’Ballance, 31. 513 Rubin, 46. 514 Ibid, 47. 515 Walker, 52.
152
Karameh, it became clear to Fatah’s leaders that good publicity could yield huge
dividends.516 Arafat’s appetite for publicity seemed unbounded, giving interviews to
Western reporters, releasing mythologized versions of his life to the media, and allowing
himself to be filmed living in caves with his fighters.517
Fatah began to invest more in its public image, using a radio station in Cairo for a
short period every day to broadcasts threats and communiqués designed to inspire
Arabs.518 Arafat attempted to generate widespread public support in Jordan’s East Bank,
trying to achieve what he had failed to do in the West Bank.519 However, when Fatah
incursions from Jordan drew Israeli troops into the East Bank, many residents of the
Jordanian Valley were forced to flee their homes and move away from the border.520
Fatah’s publicity push faced additional obstacles when the group began to fear that Israeli
assassination squads were exploiting Fatah’s openness to track down its leaders.521
Fatah found fertile ground for their activities in Lebanon as the Lebanese
population initially lent support to Fatah.522 Fatah used many tactics to gain popular
support. For example, in Sidon, a town south of Beirut, students would only receive
education credits if they were members of Fatah.523 Fatah and the PLO also co-located
their headquarters and training facilities with large refugee populations. Co-location in
516 Ibid, 52. 517 Ibid, 53. 518 Ibid, 59. 519 Yaari, 245. 520 Ibid, 245. 521 O’Ballance, 87. 522 Helena Lindholm Schulz with Juliane Hammer, The Palestinian Diaspora: Formation of Identities and Politics of Homeland, (Routledge, Taylor and Francis Group: London, 2003), 121. / O’Ballance, 91. 523 Becker, 150.
153
refugee camps also had a sharper edge in that an Israeli strike against Fatah facilities and
personnel could also result in the deaths of innocent refugees. Indeed, when Israel
bombed refugee camp military bases in Lebanon in 1980, thousands of innocent refugees
were killed and injured, generating an upwelling of anger towards Israel.524
Resources. During the 1967 to 1982 period, Fatah had access to funding, training,
and a large pool of recruits. In 1968, Fatah sent 500 volunteers from the West Bank to be
trained in Syria, Iraq, and Algeria.525 In some instances, Fatah camps in Syria were even
staffed with Syrian military personnel and stocked with Syrian arms and ammunition.526
It is important to note, however, that Fatah’s relationship with Syria was often rocky as
Syria tried to control and at times weaken Fatah and the PLO to advance Damascus’s
political agenda.
Arafat dispatched a select group of terrorists to train in Egyptian military and
intelligence schools.527 Fatah also made a push to recruit Palestinian students in Europe
for operations in the Middle East.528
Fatah’s fund-raising efforts during this period increased as the group focused on
establishing links to Palestinian worker, student and professional organizations
throughout the Middle East.529 Fatah also received financial assistance from the Chinese
and Soviet governments.530 In the mid-1970s, Fatah had enough money to pay every
524 Ibid, 188. 525 Ibid, 79. 526 O’Ballance, 38. 527 Aburish, 79. 528 Schiff and Rothstein, 74. 529 Aburish, 79. 530 Posner, 72.
154
adult male member of the organization between 700 and 1,000 Lebanese pounds
monthly—approximately what an average Lebanese farm worker would earn.531 Fatah
was also aggressively training the next generation of terrorists. Its youth movement,
called the Lion Cubs, would train 12-year olds in basic military skills, including hand-to-
hand combat, explosives, and shooting.532
Fatah continued to rely on Syrian support once it had established itself in
Lebanon, though its relationship with Syria remained rocky. Around 3,000 fedayeen fled
Jordan to seek refuge in Syria, but the Syrian government imposed onerous restrictions
on them.533 A road leading from Fatahland to Damascus, known as the ‘Yasser Arafat
Trail’, became Fatah’s main supply route in the late 1960s.534 As Fatah’s strength in
Lebanon grew, Syrian President Hafaz al-Asad struggled to keep Fatah in check, viewing
Lebanon as Syria’s prize.535 In June 1976, the Syrian army invaded Lebanon and
conquered almost all the areas previously held by Fatah.536
Despite its setbacks, PLO groups committed more than eight thousand terrorist
acts between 1969 and 1985—435 of them abroad—killing more than 650 Israelis and 28
Americans.537
Intelligence. Fatah’s intelligence capabilities continued to be fairly basic in the
1967 to 1982 period. Fatah collected intelligence for sabotage operations largely directed
531 Becker, 148. 532 Ibid, 188. 533 Walker, 139. 534 Becker, 93. 535 Rubin, 80. 536 Ibid, 80. 537 Rubin, 41.
155
against civilian targets, such as factories, private homes, cinemas, buses, restaurants, and
open markets.538 Thus, it is possible that the most valuable intelligence for Fatah was
information on how to best approach and attack these soft targets. Fatah continued to use
Israeli Arabs as guides and to get access to storage areas and accommodations inside
Israel.539
The Urban Terrorist Minimanual emphasized two types of espionage: information
gathered from recruited informants within the adversary’s ranks and information gathered
from unwitting members of the local population. The manual notes: “The urban
terrorist, living in the midst of the population and moving about among them, must be
attentive to all types of conversations and human relations, learning how to disguise his
interest with great skill and judgment. In places where people work, study, and live, it is
easy to collect all kinds of information on payments, business, plans of all kinds, points
of view, opinions, people's state of mind, trips, interior layout of buildings, offices and
rooms, operations centers, etc.”540 Though there is no evidence that Fatah penetrated the
Israeli security forces, Israeli Arabs working with Fatah most likely gathered intelligence
through the second mode of espionage described above. Additionally, Fatah managed to
penetrate the Jordanian army in 1968, successfully recruiting a number of middle-ranking
officers.541
When Fatah and the PLO controlled a large swath of territory in Lebanon in the
1970s their intelligence capabilities improved. They moved from almost exclusively
538 Ibid, 137. 539 Ibid, 140. 540 Marighella. 541 Walker, 66.
156
targeting civilian infrastructure to targeting more commercial and military infrastructure,
including oil installations, embassies, and airports.542 The PLO and Fatah used their
prisons, such as their largest prison in Sidon, to gather intelligence through the
interrogation of detainees.543 Fatah also developed the ability to rapidly communicate
intelligence to vital parts of its organization. Soon after the Israeli raid of Beirut in April
1973, Fatah broadcast urgent messages to its followers to scatter and seek shelter, as
Israeli agents were assumed to be looking for key Fatah members in Beirut.544
Counterintelligence: 1968 - 1972.545 After Fatah’s propaganda victory in the
Battle of Karameh, the group relaxed its counterintelligence posture in order to capitalize
on its windfall of popular support. Fatah leaders gave interviews to the press, appeared
on television, and appeared in public with their bodyguard entourage.546 The position of
leaders and units were still kept secret, and junior leaders and rank-and-file terrorists
were not allowed to seek individual publicity.547 Arafat was almost captured by Israeli
security forces in West Bank in the late 1960s, but he escaped his Ramallah compound as
it was being stormed and managed to hide in a Volkswagen parked nearby.548
Arafat’s affiliation with Fatah was first announced in April 1968, when he was
appointed the organization’s official spokesperson, though his birthplace and family and
542 Becker, 101. 543 Ibid, 146. 544 Christopher Dobson, Black September: Its Short Violent History, (Macmillan Publishing Co., Inc: New York, 1974, 124. 545 The counterintelligence assessment of Fatah is broken into three sections, (1) 1968-72, (2) 1972-82, and (3) a comprehensive look from 1967-82, to better highlight the key CI events and effects of the variable shifts. 546 O’Ballance, 51. 547 Ibid, 51. 548 Schiff and Rothstein, 78.
157
political background were kept secret.549 Fatah’s Damascus headquarters were also kept
secret, in addition to the group’s structure and size.550 All Fatah leaders had aliases and
contacted members in the Persian Gulf, Europe and Lebanon through couriers and liaison
men using crudely coded letters.551
Over the next several years, Fatah would gain a renewed appreciation for
maintaining strong counterintelligence awareness. One of Fatah’s most vexing security
problems was the exposure of its bases to its Arab and Israeli adversaries. In 1969,
Israeli air strikes inflicted a significant portion of Fatah’s loses, causing the terrorists to
frequently search for new hiding places.552 In 1969, almost ten percent of Fatah’s loses
were inflicted by Israeli air raids.553 Following a demonstration in Tripoli, Lebanon in
1969, the Israeli Air Force conducted air strikes against PLO bases in the region.554 In
May 1970, Israeli forces attacked Fatahland, destroying nineteen terrorist bases and
killing about 100 terrorists.555 Also in 1970, the Jordanian army began its campaign
against Fatah, shelling terrorist bases in Amman and other Jordanian cities.556 Terrorists
were instructed, as a result, to keep on the move from cave to cave. Fatah also obtained
anti-aircraft weapons, dug underground trenches and strictly enforced the use of
camouflage.557
549 Yaari, 11. 550 Ibid, 267. 551 Ibid, 267. 552 Ibid, 357. 553 Yaari, 359. 554 Becker, 96. 555 Ibid, 99. 556 Cooley, 114. 557 Yaari, 356.
158
By interrogating captured Fatah terrorists, Israel sometimes gained a huge
advantage—one Fatah member exposed an entire network in the early 1970s, turning
over the names of seventy Fatah members.558 In some cases, Fatah cells infiltrated into
the West Bank were instructed not to form relationships with the local population, for
fear of informants lurking among the locals.559 Some Fatah elements were instructed not
to conduct recruitment campaigns, since leaders feared that rapid expansion would lead
to a lapse in security.560
When the Jordanian army began to rout Fatah in 1971, Fatah leaders advocated
for a return to greater secrecy, shunning the publicity of the late 1960s.561 The problem
facing Fatah, however, was that its leaders were already known to the Arab and Israeli
security forces so going back ‘underground’ would be nearly impossible for these
individuals.562
Counterintelligence: 1972-1984. Fatah moved to the controlled territory in
Fatahland after being driven from Jordan. The large controlled territory offered
numerous benefits. By 1975, Arafat reigned supreme over this territory in southern
Lebanon as well as the southern districts of Beirut.563 Free of Lebanese government
interference, Fatah could provide its leaders with unfettered security as well as
intelligence on activities in its territory.564 For example, when BSO leader Salameh
558 Bar-Zohar and Haber, 118. / Yaari, 197. 559 Yaari, 375. 560 Yaari, 378. 561 O’Ballance, 168. 562 Yaari, 187. 563 Aburish, 151. 564 Ibid, 151.
159
stayed in Beirut in the early 1970s he would always travel with a large bodyguard
entourage.565 This made it difficult for the Israelis to assassinate Salameh, as he rarely
was left unprotected or defenseless.566
A second benefit of the controlled territory was that it allowed Fatah to
opportunity deceive Israeli overhead and ground imagery intelligence. Fatah’s attempts
to disguise military vessels, equipped with cranes for lowering rubber dinghies, as
ordinary fishing vessels docked in Lebanese harbors was probably an attempt to deceive
such intelligence collection.567
A third benefit of the controlled territory was that it allowed Fatah a brief respite
from the control of its state sponsors. As Fatah launched terrorist operations from
Lebanon’s southern border, Israel warned the Lebanese government that Israel would
continue to occupy and carry our attack in southern Lebanon as long as Fatah
remained.568 The Lebanese government, however, could do little to impede Fatah and
PLO terrorist activities, in contrast to the governments of Jordan and Syria that could
more easily control Fatah terrorists in their territories.569
The controlled territory also presented a number of counterintelligence
drawbacks, which the Israelis were quick to exploit. The chief drawback was that Fatah
and PLO bases and supply routes were plainly observable to the adversary, and thus
vulnerable to air strikes and shelling. In 1969, the Israeli air force was easily able to
565 Bar-Zohar and Haber, 160. 566 Ibid, 213. 567 Posner, 47. 568 El-Rayyes and Nahas, 106. 569 Bavly and Salpeter, 178.
160
bomb Fatah bases deep inside Jordan.570 Following the BSO attack in Munich in 1972,
Israel attacked numerous Fatah and PLO positions and refugee camps, including the
supply routes emanating from Fatahland.571 During Operation Litani in March 1978,
Israel struck Fatah and PLO targets deep inside Lebanon, including bases, refugee camps,
ammunition dumps, and training facilities in a sports stadium in southern Beirut.572
When the Israeli military moved into southern Lebanon they were able to locate arms
caches and target refugee camps for mass arrests.573
A second drawback was that controlled territory drew Fatah into complacency
and occasionally counterintelligence sloppiness. In spite of the Minimanual’s admonition
that the urban terrorist “must not write or hold any documents,” Fatah kept many files
and occasionally failed to destroy them during Israeli raids. When Israeli security
services captured Fatah files of terrorists, supporters, and sleepers during a Beirut raid in
1973, it resulted in a massive round up of terrorists within a few days.574 During
Operation Litani in 1978, Israeli security services were able to capture PLO registration
lists, which allowed them to locate key terrorist leaders and support elements in southern
Lebanon.575
Though Fatah’s controlled territory made the organization a harder target for
Israel’s security services, it was still vulnerable to Israel’s human intelligence network.
570 The New York Times, “Information Bank Abstracts,” March 16, 1969, Page 21, Column 1. 571 Cooley, 129. 572 Gabriel, 62. 573 Ibid, 107. 574 Dobson, 124. 575 Gabriel, 114.
161
Israel skillfully used human spies to infiltrate Fatah’s safehaven in order to pinpoint
bombing targets in Beirut and collect intelligence on Fatah leaders.576 This allowed Israel
to increase the accuracy of its air strikes and increasingly avoid destroying purely civilian
installations, within which Fatah and the PLO had traditionally ‘hid’ themselves. One
Israeli spy was able to get close to the lieutenant of Fatah leader Abu Iyad in Beirut,
serving as his family’s baby-sitter. This access allowed her to photograph documents in
his house detailing the names of PLO members, forged ID papers, and the time and
location of impending attacks.577
Though Syria was one of Fatah’s key sponsors, Damascus’s hold on the group
occasionally placed Fatah and the PLO at a major counterintelligence disadvantage. For
example, Syria arrested and jailed Arafat in the mid-1960s when he was perceived to be
acting too independently.578 Syrian intelligence may have supported Palestinian terrorist
Sabi Khalila Bana, also known as Abu Nidal, in his campaign to intimidate and discredit
PLO leaders in the mid 1970s, probably to further reign in Arafat.579 In 1983, Syria
recruited Fatah leader Abu Musa to rebel against Arafat, though the Syrian-inspired coup
ultimately failed.580
Syria also intervened militarily against the Palestinians in Lebanon in 1976. 581
Though it is not certain that Damascus used its extensive knowledge of the military and
576 Posner, 10. 577 Ibid, 62. 578 Byman, 127. 579 James Dorsey, “Syria tries to discredit PLO: a tale of intrigue and murder,” The Christian Science Monitor, August 5, 1981, pg. 5. 580 Byman, 128. 581 Byman, 127.
162
leadership structures of Fatah and PLO to fight against them, it seems a reasonable
assumption. Fatah probably enjoyed a partial respite from Syrian meddling when it
occupied Fatahland, though Syria continued to harass and compromise Fatah assets
throughout the group’s lifetime.
In this period, Fatah appears to have adopted methods detailed in the Minimanual
of the Urban Terrorist. Counterespionage is key focus in the Minimanual: “[T]he enemy
encourages betrayal and infiltrates spies into the terrorist organization. The urban
terrorist's technique against this enemy tactic is to denounce publicly the spies, traitors,
informers and provocateurs. For his part, the urban terrorist must not evade the duty—
once he knows who the spy or informer is—of physically wiping him out.”582 In accord
with this philosophy, Fatah tortured and killed many informants in public.583 The
Minimanual also stresses setting up a formal counterintelligence service, which Fatah
initiated in the late 1960s: “For complete success in the battle against spies and
informers, it is essential to organize a counter-espionage or counter-intelligence
service.”584 Before Fatah sent new recruits to training, every new member was
interrogated by Fatah’s counterespionage service, the Jihaz al Razd.585
Counterintelligence Adaptations: 1972 – 1984. Fatah and the PLO responded to
Israeli counterterrorism efforts by increasing its counterintelligence and security efforts.
After Israel raided Beirut in April 1973, terrorist leaders were instructed to change their
apartments at least once a month, keep their new addresses secret, and discontinue use of
582 Marighella. 583 Becker, 147. 584 Marighella. 585 Yaari, 282.
163
official PLO vehicles.586 Every time Israel pulled off an intelligence success, Fatah and
the PLO would initiate a flurry of counter-espionage activity to root out potential
informants.587 Fatah used brutal interrogations to get intelligence out of captured
informants. Fatah tortured one Israeli spy by burning her skin with cigarette butts and her
mouth with a hot electric curling iron. The same spy was subject to mock executions,
where she was forced to write a farewell letter to her family, convinced she would soon
be killed.588
Arafat continued to develop strategies for keeping himself secure. He would
sleep in the back of cars and be on the move constantly.589 Arafat frequently abandoned
appointments in order to keep an unpredictable schedule.590 He would periodically try to
feed his adversaries misinformation though suspected informants and reduce the
adversaries’ confidence in their human sources.
Summary. For the most part, Fatah had a tightly organized command structure,
high resources and strong adversaries. Fatah’s leaders were well-protected inside its
controlled territories of Jordan and Lebanon in contrast to the uncontrolled territory of the
Gaza Strip and West Bank. This is due, at least in part, to the fact that West Bank
communities were not as supportive as those in Jordan and Lebanon.
Fatah provided its members with training in intelligence and counterintelligence.
Though some of this training took place in Palestinian refugee camps, more advanced
586 Dobson, 124. 587 Ibid, 129. 588 Posner, 76. 589 Aburish, 174. 590 Ibid, 174.
164
training for elite members probably took place outside Fatah’s controlled territories in
places like Syria and Egypt. Some of Fatah’s counterintelligence advantage came from
recruiting guerrillas with experience in hiding from Arab intelligence services. The
training Fatah provided its members was almost certainly better when it controlled
territory.
BSO Timeline: 1971 - 1978
BSO Background
BSO was formed by the Fatah Central Committee in the wake of the Jordanian
government crackdown on Fatah in September 1971, from which BSO derived its name.
BSO was designed to be disconnected from Fatah’s traditional hierarchy and to live and
operate outside of Fatah’s traditional theater of operations. In many ways, BSO remained
1971: BSO Kills Jordanian Prime Minister
1972: Munich Olympics Attack
1972: Jordan Catches Abu Daoud
Jan. 1973: BSO Tries to Assassinate Israeli Prime Minister
April 1973: Operation Spring of Youth in Beirut
March 1973: BSO Takes Over Saudi Embassy in Sudan
1975: PLO Granted Observer Status in UN, Arafat Decides to Terminate BSO
1979: Salameh Assassinated in Beirut by Israeli Agents
165
connected to Fatah in that its leaders probably consulted regularly with Fatah leaders,
received funding regularly, and relied heavily on Fatah connections to build its networks.
BSO remained operationally distinct, however, insofar as its operations were
geographically dispersed and not directly launched from Fatah’s controlled territory of
Lebanon. BSO was essentially a covert paramilitary arm of Fatah, detached from the
organization operationally but connected to the organization ideologiocally and
financially.
BSO 1971 - 1978
Adversary Counterterrorism Capability. Throughout its lifespan, BSO was
hunted by the very capable Israeli intelligence services. In the first several months of
1972, Israel was preoccupied with Fatah terrorists operating in the Middle East and was
not yet hunting down BSO operatives in Europe.591 One of BSO’s first European
operations was the kidnapping of several Israeli athletes during the 1972 Munich
Olympics. The success of BSO’s kidnapping operation was due, in part, to the lenient
security at the Olympic Village.592
Following the Munich Olympics, Israel initiated Operation Wrath of God, where
a team of Israeli assassins was dispatched to Europe to hunt down members of BSO.
Mike Harari, leading the Israeli assassins, conducted the initial reconnaissance in the
Middle East and Europe, picked the assassination teams, and then moved the teams to
safe houses in Paris.593 Israel used about 15 agents divided into five squads: two
591 Bar-Zohar and Haber, 114. 592 Reeve, 1. 593 Ibid, 161.
166
assassins, two backups, two logistics men for renting safehouses and cars, seven agents
conducting surveillance, and two communications specialists.594
Israel methodically assassinated key BSO members throughout Europe and the
Middle East. The first assassination was Wael Zwaiter, who worked in Rome at the
Libyan Embassy and organized BSO attacks in Italy.595 The second assassination was
Dr. Mahmoud Hamshiri, head of BSO in France, in Paris in 1972. In January 1973, the
Israeli squad killed Hussein Abad al Chir, a senior Fatah official and liaison with the
Soviet KGB, in Cyprus.596 In April 1973, the squad moved back to Paris to kill Dr. Basil
al Kubaissi, BSO’s quartermaster in Europe who arranged for the transfer of weapons and
explosives to BSO operatives.597 In May 1973, Israeli commandos stormed a BSO-
hijacked flight after it landed in Israel, killing and capturing several BSO terrorists.598
Israel proved it could hit more challenging BSO targets as well. In April 1973,
Israeli security forces launched Operation Spring of Youth where they successfully
tracked down and assassinated several key BSO leaders in the heart of their Beirut
stronghold.599 Just hours after the Beirut operation, Israeli agents in Athens killed Zaiad
Muchasi, head of BSO in Cyprus. Israel then killed two junior BSO members in Rome
594 Ibid, 162. 595 Ibid, 164. 596 Ibid, 167. 597 Ibid, 169. 598 Ibid, 38. 599 Reeve, 176.
167
and Mohammed Boudia, the new head of BSO in France.600 Arafat estimated that more
than sixty BSO operatives were killed between September 1972 and July 1973.601
As Israeli security forces began to overwhelm BSO in Europe, BSO leaders
shifted their focus to softer targets in Southeast Asia, Africa, and the Persian Gulf.602 For
years Israeli squads stalked key BSO leader Ali Hassan Salameh, finally catching up with
him in Beirut in 1978 where they were able to kill him as he eventually relaxed his
security procedures.603 The collateral damage from the Salameh assassination was large
however, to Israel’s political disadvantage, as eight bystanders were also killed.
BSO eventually came to an end sometime in the late 1970s from the combination
of Israeli counterterrorism efforts and Arafat’s desire to shut the group down after the
PLO was granted observer status in the UN in 1975. Interestingly, Arafat shut the group
down by marrying off approximately 100 BSO operatives to Palestinian women in
Lebanon, and providing them with an apartment, a salary, and a nonviolent PLO job.604
As former operatives were married and started families, their desire to continue terrorist
operations was curtailed, according to a former deputy to Abu Iyad.605
Controlled Territory. BSO did not reside in or launch operations from Fatah’s
controlled territory—though they had occasional access to them. BSO operatives and
supporting units were spread out among the populations of Europe and the Middle East,
600 Reeve, 184. 601 Walker, 92. 602 Bar-Zohar and Haber, 161. 603 Reeve, 205. 604 Bruce Hoffman, “All You Need is Love: How the Terrorists Stopped Terrorism,” The Atlantic Monthly, December 2001. 605 Ibid.
168
commanding no specific territory. BSO did not regulate physical access to or security
within its operating environments in Europe and in fact was often monitored or harassed
by European and Arab law enforcement elements.
Organizational Structure. Fatah’s leaders selected ten young men to head the
BSO, which was designed to be small, well trained and able to strike Israeli targets
abroad.606 BSO reflected Fatah’s frustration with its secrecy and counterintelligence
lapses and Fatah hoped BSO would better harness the advantages of the secret
‘underground.’607 Importantly, BSO would be separate from the Fatah hierarchy and
Arafat hoped that Fatah could maintain plausible deniability should the BSO fail or
publicly embarrass itself.608
BSO may have relied on a small council of leaders rather than a single chief.609
Many of the key leaders, including Salameh and Abu Iyad, had served in Fatah’s Jihaz al
Razd intelligence service.610 Abu Iyad was BSO’s most senior leader and Mohammed
Abu Najjer, also known as Abu Yussef, took charge of BSO’s overall strategy.611 Fakhri
al-Omri served as Iyad’s confidant and right-hand man.612
The group probably had a cell-based infrastructure and family affiliations were
likely important to group cohesion and organization.613 The group was highly
606 Bar-Zohar and Haber, 103. 607 El-Rayyes and Nahas, 24. 608 Reeve, 34. 609 Aburish, 124. 610 Bar-Zohar and Haber, 97. 611 Ibid, 111. 612 Aaron J. Klein, “Striking Back: The 1972 Munich Olympics Massacre and Israel’s Deadly Response,” (Random House: New York, 2005), 33. 613 Crozier, 8.
169
compartmentalized and operatives selected for a mission knew few operational details
until the mission was in progress.614
BSO used Palestinians and Arabs who had lived in Europe for years as students,
teachers, diplomats and businessmen.615 These individuals knew nothing about BSO
operations beyond their personal assignments. BSO ‘employed’ close to one hundred
people of this type.616 Mahmoud Hamshiri, Fatah’s chief in Paris, built a French Fatah
network that included native Frenchmen and non-Arab anarchists.617 It is likely that most
BSO operatives were brought into the group for special missions, at which point they
would go into training and swear allegiance to BSO.618 It is unlikely that BSO had a
large inactive pool of operatives waiting to be assigned to an operation.
For example, when BSO took hostages at the Embassy of Saudi Arabia in
Khartoum, Sudan, the operation was planned and organized by one BSO member, Fawaz
Yassin, Fatah’s representative in Khartoum. As one of the few obvious culprits of the
operation, Yassin flew out of Sudan a few hours before the operation began.619
A few of the support personnel were Sudanese nationals.620 One operative was
local Palestinian news reporter Abu Salem, who worked on the Voice of Palestine
614 Bar-Zohar and Haber, 119. 615 Cooley, 123. 616 Klein, 33. 617 Jonas, 144. 618 Dobson, 47. 619 The New York Times, “Information Bank Abstracts,” March 8, 1973, Page 10, Column 1. 620 The New York Times, “Information Bank Abstracts,” March 8, 1973, Page 10, Column 1.
170
program on Sudanese radio.621 The other six operatives were flown in on Jordanian
passports and briefed on the operation the day before the attack.622
Resources. BSO was probably consistently well funded and well stocked with
recruits throughout its existence. Fatah seconded many high-quality recruits from the
Jihaz al Razd to the BSO. Many were university graduates who could speak foreign
languages and operate in foreign capitals without raising suspicion.623 Abu Iyad recruited
Ahmed Afghani, aka Abu Motassin, to look after BSO’s finances and supplies. Iyad
hired Ghazi el Husseini, an engineer, to develop and obtain sophisticated weaponry and
equipment.624
State sponsorship played an important role in BSO’s training and operations. Ten
BSO members, including Salameh and Mohammed Daoud Odeh, also known as Abu
Daoud, were given special intelligence training in Cairo as BSO was being formed.625
The Egyptian intelligence service taught the multi-month course on unconventional
intelligence operations, including modules on intelligence recruiting and sabotage.626
Libya also provided BSO with support in Europe via various Libyan embassies.
In exchange, BSO and Fatah tracked down and assassinated several Libyan exiles in
Europe for Qaddafi.627 Algerian and Libyan diplomats would carry weapons, explosives,
621 The New York Times, “Information Bank Abstracts,” March 5, 1973, Page 1, Column 1. 622 Bar-Zohar and Haber, 165. / “A Blacker September,” Time Magazine, March 19, 1973. 623 Dobson, 45. 624 Reeve, 35. 625 Ibid, 35. 626 Bar-Zohar and Haber, 103. / 2, 9. 627 Ibid, 104.
171
and communications to BSO operatives in Europe. Algerian and Libyan embassies
would issue passports and identity papers to BSO members.628 Algerian embassies may
have supplied BSO with intelligence reports produced by their security services.629
Libyan embassy employees are alleged to have assisted BSO in some terrorist operations.
Following the Sudan operation, the Sudanese government arrested and charged two
employees of the Libyan embassy in Khartoum with aiding BSO.630
Some BSO leaders worked closely with the Soviet and East German intelligence
services, the KGB and the Stasi, respectively. Abu Iyad, code named KOCHUBEY by
the KGB, met with the KGB in Moscow in June 1978.631 Hussein Abu Khair was
working as a liaison to the KGB when he was assassinated by Israeli security elements in
Cyprus in 1973.632 Abu Daoud often stayed in the Palast Hotel in East Berlin, where the
Stasi helped him to hide, providing him with an around-the-clock security detail.633
Popular Support. Fatah and its leaders laid the foundation for BSO’s European
and Middle Eastern support networks years before BSO was created. Throughout the
1960s, Arafat used the Palestinian Students’ Federation in Cairo, Baghdad and West
Germany to collect funds and recruits for Fatah.634
628 Ibid, 119. 629 Ibid, 119. 630 The New York Times, “Information Bank Abstracts,” March 8, 1973, Page 10, Column 1. 631 Christopher M. Andrew and Vasili Mitrokhin, “The World Was Going Our Way: The KGB and the Battle for the Third World,” (Basic Books: New York, 2005), 257. 632 Klein, 138. 633 Reeve, 211. 634 Cooley, 90.
172
Germany was a particularly fruitful operating environment for Fatah, where the
group drew upon the approximately 6,000 Palestinians living in West Germany.635 West
Germany was a particularly important base for BSO. Munich was home to many Arab
guest workers, including approximately 800 Jordanian workers, and German security
services did not consider these individuals to be a terrorist threat until after the Olympic
Village attack.636 Following the Munich attack, West German authorities estimated that
the three largest Palestinian organizations in the country were the General Union of
Palestinian Students (with 27 cells), and General Union of Palestinian Workers (with 24
cells), and Fatah (with 23 distinct cells).637
Two Palestinian brothers, Khalid and Hani al-Hassan, organized thousands of
Palestinian students in Stuttgart—a city that became a principal center for Fatah activity
in Europe.638 Khalid and Hani established firm connections with left-wing Palestinian
student groups in Germany and other European countries.639 Students in Germany,
Austria, Italy and Spain were occasionally selected to take short training courses in
Algeria in the use of arms and sabotage techniques.640 These students would then be sent
to Lebanon, Syria and Jordan where they would prepare to participate in terrorist
operations against Israel.641
635 Klein, 143. 636 Reeve, 228. 637 The New York Times, “Information Bank Abstracts,” September 9, 1972, Section 1, Column 4. 638 Cooley, 90. / Yaari, 40. 639 Aburish, 56. 640 Schiff and Rothstein, 76. 641 Schiff and Rothstein, 76.
173
Fatah was also successful in recruiting Palestinian students in Lebanese and
Algerian universities.642 Some of these recruited students would join Fatah’s Jihaz al
Razd, and many of them spoke European languages after studying in European
universities or at the American University in Beirut.643
BSO was able to tap into Fatah’s vibrant and deep European connections and was
able to raise a shadow army among the scholars and students of the region. Rome
became headquarters for BSO in Europe due to its proximity to the Middle East and the
generally relaxed security practices of the local police services.644 BSO operatives from
all over Europe would use Rome for secure meetings. BSO could also draw upon the
approximately 2,000 Arab students at the universities in Rome and Perugia.645
Paris also became an important arms depot and communications center for BSO
operations in Europe.646 BSO was able to draw upon the thousands of Algerian and
Moroccans workers living in Paris, some of whom were a part of the left-wing
intelligensia who had supported Algerians in their war against the French occupation.647
For example, Mohammed Boudia was able to recruit a French woman, who did not fit the
terrorist profile, to carry out one BSO attack.648
642 Yaari, 39. 643 Ibid, 39. 644 Bar-Zohar and Haber, 146. 645 Dobson, 136. 646 Bar-Zohar and Haber, 151. 647 Dobson, 137. 648 Ibid, 138.
174
Geneva also became a favored operating environment due to BSO’s ability to
blend into the large foreign and diplomatic community. Geneva was used as a transit
point for BSO operatives moving to and from the Middle East.649
Fatah opened an office in Stokholm in 1976, and the Swedish branch of the
Palestinian Workers’ Union became closely associated with the PLO.650 Many
Palestinians had gone to Sweden in the early 1960s to get supplementary education,
though many returned to Lebanon, Jordan and the West Bank after completing their
studies.651
BSO never established a presence in Britain. This most likely happened for two
reasons. First, Britain did not have a large Arab student population like Germany nor did
it have a large Arab worker population like France to provide BSO operatives
camouflage.652 Second, Britain strictly regulated movement and documentation in the
UK in contrast to the continental Europe, where movement and documentation controls
were more relaxed.653
BSO benefited directly from Fatah’s and the PLO’s popularity in Europe and the
Middle East. BSO’s affiliation with Fatah provided it financial support and credibility
among Palestinians.
649 Ibid, 135. 650 Schultz and Hammer, 84. 651 Ibid, 55. 652 Dobson, 143. 653 Ibid, 143.
175
BSO did not have to mount a massive independent campaign to generate popular
support within Europe, as the group needed only to rely on a few dedicated individuals
among the Palestinian diaspora.
BSO leaders—including Ali Hassan Salameh, Abu Yussuf Najjar, Hani al-
Hassan, Khalil al-Wazir and Abu Iyad—returned to the security of the pro-Fatah
communities of the Fakhani district of west Beirut and Fatahland as BSO was being
eviscerated in Europe.654 This demonstrates that key BSO leaders and operatives had
access to Fatah’s controlled territory, though most likely returning to Lebanon took these
operatives out of the ‘terrorist game’ permanently or semi-permanently. The upwelling
of pro-Fatah sentiment in Beirut was related to Fatah’s quasi-government role in
Lebanon—Fatah was the second largest employer in west Beirut, after the Lebanese
government, and had its own police and fire departments, hospitals, and factories making
furniture, clothing, and ammunition.655 When Israel assassinated Fatah leaders Kamal
Nasser, Kamal Adwan, and Abu Yussuf Najjar during the Operation Spring of Youth in
1973, nearly half a million Lebanese marched in their funeral cortege.656 Arafat had the
support of the most radical Palestinian organizations, such as the Popular Front for the
Liberation of Palestine, and the relative moderates, such as the West Bank mayors and
654 John Kifner, “West Beirut Bids Farewell to the PLO,” The New York Times, August 23, 1982. 655 John Kifner, “West Beirut Bids Farewell to the PLO,” The New York Times, August 23, 1982. 656 Rashid Khalidi, “Under Seige: PLO Decisionmaking During the 1982 War,” (Columbia University Press: New York, 1985), 23.
176
Arab leaders throughout the Middle East.657 BSO occasionally fed off of this popularity
to improve its own security.
Intelligence. BSO’s intelligence capabilities, though in many instances not
directly observable, can be partially gleaned from the quality of its operations. BSO
assassinated several targets that would have required sophisticated surveillance or insider
knowledge, including an Israeli intelligence officer in January 1973 and an Israeli deputy
military attaché in Washington in June 1973.658 In 1971, BSO also killed the Jordanian
Prime Minister Wasfi Tal while he was attending the Arab League summit in Cairo and
almost killed the Jordanian ambassador in London.659 For Prime Minister Tal’s
assassination, BSO members Essat Rabah and Monzer Khalifa flew in from Beirut before
the attack and waited for Tal in the lobby of his hotel.
BSO also attacked a number of factories in Germany and gas installations in the
Netherlands in the early 1970s that were allegedly connected to Israeli interests.660
Attacking these individuals and installations indicates that BSO employed relatively
successful methods for surveilling its targets.
BSO used a network of accomplices in Europe to do some of its intelligence
gathering. For example, the BSO operation to blow up the trans-alpine oil pipeline in
Italy in August 1972, involved an Italian and two Frenchmen.661 The oil pipeline was
targeted because it served as a main feeder point for Middle Eastern and North African
657 Thomas Friedman, “Arafat Leads the PLO into Toughest Salvage Operation,” The New York Times, July 11, 1982. 658 Crozier, 9. 659 Crozier, 14. 660 Dobson, 65. / Cooley, 124. 661 Ibid, 47.
177
oil flowing into Europe.662 Salameh, in particular, tapped into a network of radical
European groups for some of his intelligence.663 BSO in Germany used its extensive
links to Palestinian students and the General Union of Palestinian Workers to improve its
intelligence gathering.664
BSO’s pre-operational reconnaissance for the Munich mission reflected its
reliance on both BSO leaders and locals to gather intelligence. One of the architects of
the Munich operation, Abu Daoud, began reconnaissance for Munich in July 1972.
Daoud arrived in Munich, familiarized himself with the city streets, and began collecting
information on hotels and flights into and out of the city—Jordanian security services
would later catch Daoud casing government buildings in Amman for a major BSO attack
planned by Abu Iyad.665
Intelligence gathering for the Munich operation continued with two Palestinian
operatives, Luttif Afif and Yusuf Nazal. Afif, aka Issa, had lived in Germany for five
years and attended the University of Berlin and took a job as a civil engineer in the
Olympic Village to surveil BSO targets.666 Nazal, had worked for a Munich oil company
and took a job in the Olympic Village as a cook to conduct surveillance. These temporary
jobs allowed the men to roam freely through the village, case the Israeli living quarters
and gather information about the Israeli athletes.667
662 Cooley, 124. 663 Bar-Zohar and Haber, 118. 664 O’Ballance, 216. 665 Reeve, 200. / Ibid, 40. 666 Ibid, 2. 667 Ibid, 3.
178
Finding Israeli agents and collaborators was also an intelligence priority for BSO.
BSO tracked down an Italian employee of El Al, who BSO suspected was an Israeli
agent, and assassinated him in April 1973.668 A few weeks after BSO’s Munich
operation, BSO operatives tracked down and assassinated a Syrian radio reporter, who
was working as an informant for Israel.669 BSO also used its network of European agents
to track down and assassinate the Israeli intelligence officer, Baruch Cohen, in 1979.670
Counterintelligence. BSO considered security and counterintelligence a high
priority throughout its existence. Arafat’s denial that BSO was a Fatah proxy group was
itself a counterintelligence tactic, designed to distract Israeli security services from
drawing connections between leaders of Fatah and BSO.671 Many BSO leaders had
experience in counterintelligence as they were seconded from Fatah’s counter-espionage
and intelligence group. Others had been longtime members of the secretive Muslim
Brotherhood, including Abu Jihad and Abu Iyad.672
BSO disseminated information on a ‘need-to-know’ basis. Beyond Abu Iyad, few
were allowed to see the complete picture of BSO’s operations and strategy.673 BSO
operatives were organized into compartmented cells and were acquainted with fellow cell
members but probably never BSO leaders or members of other cells.674 In some cases,
Fatah terrorists recruited for BSO missions were not aware they were embarking on a
668 Ibid, 169. 669 Bar-Zohar and Haber, 135. 670 Reeve, 173. 671 Dobson, 39. 672 Aburish, 35. 673 Klein, 32. 674 O’Ballance, 215.
179
BSO mission until after it was initiated.675 Some BSO leaders did not know the group’s
top leadership or where their headquarters were located.676 BSO probably assigned its
operatives aliases for most of its big operations.677
BSO operatives involved in the Munich operation were trained and dispatched to
Germany in this pattern. The six BSO operatives selected for the operation were told
they were to take special training in Libya, but were instructed not to tell their families
where they were going.678 They received about a month of advanced military training in
Libya, some of which involved jumping over high walls—operatives figured that the
training was for scaling Israeli military bases, but in fact it was for jumping over the wall
at the Olympic Village.679 Operatives were flown to Germany and briefed into the
operation only hours before it was to begin.680 After operatives were briefed on the
operation, they had to surrender their money, passports and everything else that could
reveal their identities.681 As an added counterintelligence bonus, many of the operatives
had grown up in the refugee camps together, trained together in Libya and trusted one
another.682 The chance that an informant could slip in among them was slim.
BSO differed dramatically from Fatah in its approach to publicity. When BSO
was formed, Abu Iyad argued to the Fatah Central Committee that secret methods and
operations would actually increase popular support for and the mystique of the
675 Dobson, 43. 676 O’Ballance, 216. 677 Dobson, 118. 678 Reeve, 43. 679 Ibid, 43. 680 Ibid, 44. 681 Ibid, 46. 682 Ibid, 46.
180
movement.683 Thus, BSO operatives shunned publicity in striking contrast to Fatah’s
publicity hungry leaders.684 The group would never have an official spokesperson.685
BSO would, however, occasionally conduct bogus interviews to plant disinformation.686
Israeli security services had great difficulty tracking BSO operatives in the early
1970s because of their tight security. After information began to trickle into the Israeli
services, they discovered that BSO leader Salameh was somewhere in Europe, though
they didn’t know exactly where.687 BSO also ran a double agent operation against Israeli
security services in 1973. The Moroccan Mohammed Rabah tried to get in contact with
Israeli services in the early 1970s to help them find Fatah targets in Europe.688 After
Munich, an undercover Israeli agent, Zadik Ophir, agreed to meet Rabah at a café in
Brussels, whereupon Rabah shot Ophir at point blank range.689
BSO security and counterintelligence shifted its focus when group members
operated among the Fatah-controlled areas of Lebanon. For instance, Salameh traveled
alone using forged passports when he worked abroad, but would surround himself with
armed bodyguards when he worked in Lebanon in the early 1970s.690 This suggests that
Salameh felt comfortable enough in Lebanon to increase his operational profile (e.g.
traveling with an entourage), but not comfortable enough to travel without physical
protection. The BSO leader knew he could be tracked to Beirut but also knew that he
683 Crozier, 6. 684 Cooley, 124. 685 Bar-Zohar and Haber, 110. 686 Cooley, 124. 687 Bar-Zohar and Haber, 118. 688 Ibid, 135. 689 Ibid, 135. 690 Ibid, 160.
181
could not easily be attacked once inside the Fatah territory. Salameh also constantly kept
on the move in Lebanon and rarely spent more than one night in the same apartment.691
Abu Iyad would also changed his apartment constantly when he was in Beirut, sometimes
getting up in the middle of the night to change his hideout.692 As a testament to the
advantage of security in controlled territory, Israel spent thousands of man-hours, in the
field and the office, in the hunt for Salameh—it became Israel’s longest and most costly
mission.693 Israeli agents also spent two-decades unsuccessfully chasing Abu Iyad, who
secured himself in the PLO’s Tunis safehaven.694 While BSO leaders had the ability to
secure themselves in Fatah’s controlled territory, the rank-and-file BSO operative would
not have this same access, perhaps unless he decided to quit the organization.
One of BSO’s greatest counterintelligence advantages was its ability to blend in to
the European background while planning and conducting operations. For example, the
Munich operation employed the services of Abdullah al Franji, an official at the Arab
League’s Office in Bonn, who German officials linked to BSO after finding incriminating
documents and bomb materials in his apartment.695 During the Munich operation, BSO
mission planner dressed his operatives in track suits to allow them to blend in with other
athletes climbing over the Olympic Village gates after a late night—a disguise that was
691 Ibid, 160. 692 Dobson, 43. 693 Klein, 212. 694 Klein, 231. 695 Dobson, 131.
182
so effective that BSO operatives were actually helped over the fence by a group of
returning athletes.696
BSO operatives often used forged passports and identity papers to move about
Europe and the Middle East.697 Some BSO operatives became masters of disguise.
Mohammed Boudia, head of BSO in France, constantly changed his identity and even
dressed as a women at times to throw off the French security agents assigned to monitor
his movements.698 Salameh took advantage of the natural cover available to BSO
operatives in Europe, recruiting intellectual elites who could use their blameless records,
connections to the local intelligensia and sophistication to avoid being suspected or
targeted by security services.699 BSO’s European quartermaster, Basil al-Kubaissi, relied
heavily on his status as a professor of law at the American University in Beirut to keep
himself above suspicion—though Kubaissi also employed elaborate ways of
communicating covertly and avoiding surveillance.700 When Kubaissi was assassinated
in 1973, he had nine forged passports in his possession.701 BSO also used Libyan and
Algerian embassy personnel to take care of logistics and acquire identity documents.702
Salameh was not only a master of disguise, but probably was also adept at using
deception to throw security services off his scent. It is possible that he actively planted
rumors among Palestinians in Europe that he had gone to live in Scandinavia. Israeli
696 Reeve, 1. 697 Ibid, 36. 698 Ibid, 185. 699 Bar-Zohar and Haber, 160. 700 Ibid, 157. 701 Klein, 231. 702 Dobson, 131.
183
security services picked up rumors in Geneva, Zurich and Paris that Salameh had moved
into Scandinavia—ultimately the rumors led to Israeli agents assassinating an innocent
man living in Sweden.703
Counter-espionage remained an important counterintelligence tactic for the BSO.
When Jordanian authorities caught key BSO member Abu Daoud in 1972, it was a
counterintelligence disaster for the group. Daoud revealed details of the projected BSO
operation as well as sensitive details about BSO operations in general.704 BSO leaders
were infuriated by Daoud’s confessions and went to great lengths to secure his release
from Jordanian prison so that they could execute him. The ‘Punishment Group’ took
thirteen hostages at the Embassy of Saudi Arabia in Paris in September of 1973 and
demanded Daoud’s release, though it was not granted.705
BSO experienced other counterintelligence setbacks as well. In one operation,
compartmentation led to a serious operational backfire. A mixed Japanese-Palestinian
BSO group attempted to hijack a Japanese airliner in July 1973, but the mission planner
was killed during the initial aircraft takeover. No other member of the hijacking team
was fully briefed on the mission, so the remaining terrorists had to abandon the
operation.706
Israeli intelligence efforts were sometimes able to defeat BSO’s
counterintelligence strategies. In January 1973, Salameh was planning to shoot down the
Israeli Prime Minister’s plane as she landed in Rome. Salameh used multiple passports
703 Reeve, 190. 704 Bar-Zohar and Haber, 164. 705 Reeve, 201. 706 Dobson, 47.
184
to arrange for surface-to-air missiles to be smuggled from Dubrovnik to Rome and then
stored the missiles at a PLO safe house in Rome.707 Israeli security services were able to
thwart the operation due to three sources of intelligence. First, an Israeli informant
working in the PLO gave Israel information that an operation was being planned.
Second, telephone intercepts from a PLO safehouse in Rome tipped Israel off on the
timing of the operation and the use of missiles. Third, an Israeli surveillance patrol in the
vicinity of the Prime Minister’s landing plane found the BSO’s missiles ready to launch
out of two suspicious-looking chimneys on a food cart.708
BSO also demonstrated its adaptiveness and counterintelligence resilience in this
period. During Operation Spring of Youth in 1973, Israeli commandos captured three
filing cabinets in Beirut housing part of Fatah’s and BSO’s archives and operational
files.709 Though it could have been a massive counterintelligence setback for BSO, the
group adjusted quickly to limit the damage. Unsure of the extent of the compromised
information, BSO began replacing agents, changing its codes and abandoned missions in
the planning stages.710
Following the Israeli operation in Beirut, BSO increased the protective detail of
its leaders and were instructed to change their address at least once a week.711 As BSO
leaders were assassinated in Europe, the remaining leaders increased their security
707 Reeve, 172. 708 Ibid, 172. 709 Becker, 108. 710 Dobson, 131. 711 Reeve, 184.
185
precautions. After Wael Zwaiter was killed, Mahmoud Hamshiri increased his
countersurveillance procedures, refraining from making precise appointments.712
BSO was also able to use some of Israel’s human intelligence networks to deceive
Israeli security services. In the mid-1970s, BSO discovered a Palestinian student
intelligence network that Israel had developed in Madrid.713 At first, BSO used the
network to feed false information to Israeli security services, through Israel’s case officer
Baruch Cohen. When Cohen began to suspect that several of his contacts were working
for BSO, the group decided to assassinate Cohen.714 On January 23, 1979, Cohen was
shot and killed by a 25 year-old Palestinian medical student as he was being
‘debriefed’.715 These BSO double agent operations clearly demonstrated the
sophistication of BSO’s counterintelligence methods.
BSO Summary
For the most part, BSO had a tightly organized command structure, a high level of
resources, strong adversaries and popular support, but limited access to Fatah’s controlled
territories for operational purposes. BSO was able to hide its logistical and operational
plans from Israel and its operatives had a relatively easy time blending into their
European and Middle Eastern environments. A number of BSO operatives were tracked
down and killed by Israel agents. However, these individuals were known to the Israeli
security service or were prominent members of the Palestinian community, whereas the
relatively anonymous rank-and-file BSO members were far more secure.
712 Bar-Zohar and Haber, 151. 713 Ibid, 155. 714 Reeve, 173. 715 Ibid, 174.
186
BSO used locals and their knowledge of local targets to collect intelligence for its
operations. Sympathetic diaspora communities provided fertile ground for gathering
information about the operational environment.
BSO did not conduct campaigns to increase its publicity or popular support. This
is partly due to the fact that the group tapped into Fatah’s popular base of support for
recruiting and intelligence collection purposes.
Hypotheses Revisited
Hypothesis 1(A): With a relatively tighter command and control structure Fatah
will have superior counterintelligence training and compartmentation. This is correct.
Both Fatah and BSO had tight organizational structures, and both groups were able to
train its members in intelligence and counterintelligence procedures.
Hypothesis 1(B): With a relatively tighter command and control structure Fatah
will be more vulnerable to its adversary’s efforts to develop high-level penetrations and
exploit the group’s standardized counterintelligence procedures. This is at least partially
correct. Jordan partially exploited Fatah’s standardized counterintelligence procedures
when it broadcast fake code signals calling guerrillas to Jordan where they were arrested.
BSO almost fell victim to standardization when Israel captured BSO documents during
Operation Spring of Youth. However, the BSO’s tight structure allowed it to respond
quickly to the document leakage by replacing BSO agents and changing BSO codes. On
the other hand, had BSO counterintelligence and operational procedures not been
187
standardized or centrally coordinated, the group would not have had to spend precious
resources to adapt after the document leakage.
Hypothesis 2(A): With relatively greater popular support Fatah will have greater
counterintelligence support from the local population. This is correct. Fatah almost
certainly enjoyed greater counterintelligence support from the local populations when it
had high popular support. For example, Fatah leaders could easily relocate from
apartment to apartment in Beirut in the 1967 to 1984 period while the group was
constantly ratted out in the West Bank and Gaza in the 1964 to 1967 period.
Hypothesis 2(B): With relatively greater popular support Fatah will be more
likely to expose itself in its efforts to maintain popular support. This is correct. Fatah
craved publicity, particularly between 1968 and 1971. Fatah leaders gave interviews to
the press, appeared on television, and appeared in public with their bodyguard
entourages. Fatah leaders tried to increase the group’s secrecy after 1971 but found it
difficult to go back ‘underground’ after exposing the group’s leaders and organizational
structure to the public. Fatah also had to appease local tribes and families to keep their
support, which sometimes meant not reprimanding local tribal leaders who might be
collaborating with Israel. BSO, in contrast, assiduously shunned publicity as an
organization and rarely had to deal with overexposure to the media. However, some BSO
leaders in Europe were well-known in their respective academic and professional circles
and as a result were easier to locate, monitor and capture.
Hypothesis 3(A): With relatively more controlled territory Fatah will have
superior communications security, physical security and counterintelligence vetting. This
188
is mostly correct. Israel found it difficult to track and assassinate Fatah leaders in
Lebanon as they were surrounded by bodyguards and was able to move between safe
houses with ease. Had Israel tried to strike at Fatah leaders in these conditions, they
would likely have been caught in a firing match causing a great deal of very public,
collateral damage. Additionally, the pro-Fatah community in Beirut and Fatahland could
have alerted Fatah to Israel’s efforts to surveil and track Palestinian targets. To surveil a
terrorist for assassination could require weeks of careful observation in close proximity to
the individual and his entourage of well-armed bodyguards. Thus, Israel would have to
divert energy away from tracking its targets to increasing its own counterintelligence
posture when it operated in this hostile territory.
Operation Spring of Youth, where Israeli special forces units raided an apartment
in Beirut and killed several high-ranking Fatah members, is an example of where Israel
took this risk. The half-hour-long operation cost Israel the lives of two of its soldiers as
well as hundreds of hours of surveillance of buildings and neighborhoods.716 The Israeli
operation also left in its wake a large amount of collateral damage, which could have
been worse had the Israeli commandos been forced to engage the Lebanese security
forces or the PLO guards that chased after them as they were exfiltrated from Beirut.717
In contrast, once Israel located BSO leaders in Europe they were tracked and
hunted down with relative ease and overall had worse personal protection. BSO leaders
in Europe could not change houses every night and travel with an entourage of
bodyguards as Fatah leaders could with the group’s controlled territory. In the 1964 to
716 Klein, 160. 717 Ibid, 168.
189
1967 period, Fatah also did not control territory, and the group’s physical and operational
security suffered as a result.
Hypothesis 3(B): With relatively more controlled territory Fatah will be more
vulnerable to its adversary’s efforts to track the group’s gross financial, logistical and
personnel movements. This is also correct. Israel could more easily track the movement
of persons, weapons, and supplies to and from Fatah safehavens than it could BSO
personnel, weapons and supplies through and between its operations in Europe and the
Middle East. For example, Israel sealed the border between the West Bank and Jordan,
ambushed militants on guerrilla passes in Jordan, and set up observation posts in Lebanon
to better monitor and apprehend Fatah members. Thus by watching particular territories,
Israel could estimate Fatah’s relative manpower, communications and weapons supplies.
In contrast, the rank-and-file members of BSO were more anonymous and hidden
among tens of thousands of non-combatants with similar biographical profiles. In many
cases BSO operatives were also legitimate students and workers, and BSO operatives
who participated in only one mission would leave very few operational footprints. Thus,
the difficulty of locating BSO operatives made estimation of BSO’s overall manpower,
communications and weapons supplies at any time very difficult. Even BSO members
with a large operational footprint were difficult to locate—Israel spent thousands of man-
hours in the hunt for Salameh, making it one of Israel’s longest and most costly
operations. Once located, however, these BSO operatives proved easy for the Israeli
services to apprehend.
190
For Fatah in the 1964 to 1967 period, operating outside of controlled territory did
not provide as many advantages. This is mainly because Fatah was centralized within
territory that was controlled by its adversary, which made location and monitoring of
Fatah relatively easy for Israel. Thus, a terrorist group will probably only capitalize on
the benefits of operating outside of controlled territory if its adversary also does not
control the territory of operation.
Hypothesis 4: Fatah will become increasing centralized and tightly
commanded over time in the face of external threats. Fatah and BSO were tightly
structured during all three periods, so it difficult to judge the accuracy of this hypothesis
with this case study.
Control Variables: Alternative Explanations Review
As discussed earlier, the control variables do not remain perfectly constant in the
Fatah/BSO case study, opening up the possibility that the control variables account for
some of the change in the dependent variables. While the adversary capabilities stayed
relatively constant, resources fluctuated between the three periods. For example,
variation in Fatah and BSO counterintelligence capabilities could have resulted from
differences in their overall size. Fatah was much larger than the BSO and its size
probably created a number of counterintelligence problems for the group. First, a large
group will have a larger operational profile, which would increase the group’s exposure
to the adversary’s security services. Second, a larger group will face a greater risk of
191
informants as more group members leads to less vetting and more opportunities for
Israeli forces to recruit collaborators.
There are also some counterintelligence advantages that come with size. A larger
group can employ more members as counterintelligence and counterespionage personnel.
A larger group can also delegate to ‘non-sensitive’ personnel the most dangerous tasks,
reducing the adversary’s opportunities to capture individuals that know the group’s most
sensitive secrets.
One might hypothesize that BSO’s advantage in hiding its logistical and
operational plans resulted from its small size and Israel’s inability to recruit informants
within BSO’s ranks. In fact, BSO’s size probably did provide the group with a hiding
advantage in foreign theaters of operation. However, even if BSO had been larger than
Fatah, it still would have retained its hiding advantage in its relatively enormous
operating environments such as Europe. BSO’s foreign theaters were so large, that its
size would not have significantly changed its ability to hide. On the contrary, in Fatah’s
safehavens Israel knew precisely the towns and neighborhoods to target for intelligence
operations—or air force strikes—because these safehavens were not mobile. Even if
Fatah had been very small, Israel still would have been able to monitor the group’s
logistical and operational activity in a relatively discrete operational area like the city of
Beirut or the Gaza Strip.
Variation in counterintelligence capabilities could have resulted from differences
in Fatah’s and BSO’s popular support between Periods One, Two and Three. BSO spent
less time generating popular support and publicizing its achievements and information
192
about its members. As a result, BSO should have suffered from fewer
counterintelligence leaks, as posited by Hypothesis 3(B). This is also probably true to an
extent. Fatah leaders expressed frustration that they could not return to an “underground”
movement once they had embraced the pubic spotlight. BSO leaders also suffered from
publicity, though much of it was not purposefully sought out. In some cases, Israel was
able to track BSO leaders in Europe as a result of their high-profiles. For example,
Mahmoud Hamshiri was Fatah’s public chief in Paris, Basil Kubaissi was a well-known
law professor, and Wael Zwaiter a well-known scholar.
Variation in Fatah’s counterintelligence capabilities could also have resulted from
differences between the goals and missions of Fatah and BSO between the time periods.
There are several important differences between Fatah and BSO’s missions. First, Fatah
engaged in some military-on-military insurgency operations while BSO engaged
exclusively in civilian target terrorist operations. Second, Fatah operated among and
interfaced with its popular support base while BSO slipped relatively anonymously into
the background of its theaters of operation. Both of these factors could have allowed
BSO to remain more anonymous and could have improved BSO’s counterintelligence
capabilities. Thus, it is difficult to tell whether BSO’s relative ease in hiding its members
and logistical plans was a result of operating outside of controlled territory or a result of
having a lower operational profile.
One way is test this proposition is to see if there were any direct benefits to BSO
as a result of operating outside of controlled territory, regardless of its mission. There is
evidence that it was BSO’s physical detachment from controlled territory, rather than its
193
mission and goals, which directly provided the group with its greatest leverage over
Israeli security services. Outside of the controlled territory, there were too many
populations to monitor and too many diaspora communities to penetrate and dissuade. In
contrast, Israel could more easily monitor Fatah’s controlled territory in order to recruit
informants and target or threaten potential Fatah collaborators.
Another way to partially test this proposition is to compare Fatah in 1964 to 1967
period, when it operated without controlled territory, but with a mission similar to that of
Fatah in the 1967 to 1982 period. In the 1964 to 1967 period, Fatah had severe
counterintelligence problems and was eventually routed by Israeli counterterrorism
forces. This was mostly due to the fact that Fatah was operating in territory controlled by
its advarsary and was thus both easy to locate and track and easy to apprehend with little
resistance. This suggests a caveat to Hypothesis 3(B): a terrorist group acquires the
benefits of operating outside of controlled territory on the condition that the territory it
operates in is also not controlled by the adversary.
Lessons from the Fatah/BSO Case Study
The Fatah case study provides support for several hypotheses and provides insight
into potential interactions between the independent variables and between the intelligence
and counterintelligence variables.
First, having access to controlled territory has both advantages and disadvantages
for intelligence and counterintelligence operations. Controlled territory allowed Fatah to
police a geographical area within which it could track and capture informants, conduct
194
background checks on recruits, increase its popular support, insulate its leaders from
foreign security services, and develop a media function to inspire and communicate
intelligence to its members. Controlled territory also produced some complacency, which
decreased Fatah’s counterintelligence posture. For example, Fatah kept paper records
and files on its members and operations without developing a means of destroying them
in an emergency. This proved disastrous for Fatah on a number of occasions when these
records were captured by Jordanian and Israel security forces.
Second, state sponsorship has both advantages and disadvantages for intelligence
and counterintelligence operations. State sponsorship provided Fatah and BSO with
high-quality training, protection from hostile security services, financial assistance,
identity papers and logistical support for operations, and even raw intelligence on targets.
On the other hand, key state sponsors such as Syria often tried to control and weaken
Fatah when the group acted against the Syria’s interests.
Third, campaigns to increase popular support may be a necessary evil for
clandestine terrorist groups, but they may exact a huge counterintelligence cost on the
group. Campaigns to increase popular support provided valuable targeting data to the
adversary and made it very difficult for terrorist leaders to return ‘underground’ once
they had become popular.
195
CHAPTER FOUR: AL QAEDA
In the early 1990s, al Qaeda had relatively little international popular support but
enjoyed a high level of local security in its controlled territory in Sudan. In the mid
1990’s, al Qaeda dramatically increased its publicity campaigns and attacks against its
adversaries, and as a result significantly increased its international popular support. This
popular support led directly to improvements in al Qaeda’s international intelligence and
counterintelligence capabilities. At the same time, al Qaeda began to suffer from many
new security and counterintelligence problems in its local controlled territory. How
could al Qaeda’s campaign to increase its popular support simultaneously advance its
international counterintelligence capabilities and impede its local counterintelligence
efforts?
The case study will show that al Qaeda’s campaign to increase its international
popular support introduced numerous counterintelligence and security challenges in its
local controlled territory. These challenges arose as al Qaeda raised its operational
profile to connect with media organizations and inspire its international supporters with
details about al Qaeda’s leaders and terrorist plans. Additionally, the case will show that
al Qaeda’s efforts to improve its local counterintelligence posture occasionally introduced
counterintelligence problems for the group’s international operations. The case provides
a good test of Hypothesis 2A and 2B. The large-N data set offered preliminary support to
these hypotheses, but the al Qaeda case offers an in-depth look at the causal mechanisms
driving the relationships between counterintelligence and popular support.
196
In this chapter, I first provide a discussion of the key hypotheses and alternative
hypotheses, followed by the al Qaeda case study. I then review the hypotheses and
provide a general assessment of how a terrorist group’s popular support may impact its
intelligence and counterintelligence capabilities.
The al Qaeda case study is broken into three parts. The first part depicts al Qaeda
from its inception in 1988 until its departure from Sudan in 1996, when the group had
relatively little international and local popular. The second part depicts al Qaeda from
1996 until the initiation of U.S military operations in Afghanistan in 2001, when the
group enjoyed relatively high international popular support but relatively little local
popular support. The third case focuses on the group from 2001 until 2003, when it
enjoyed high levels of both international and local popular support.
To sharpen the differences between al Qaeda’s local and international conditions,
the resources, popular support, intelligence and counterintelligence variables are
measured separately for each period in local and international subsets.718
Al Qaeda Case Study Core Hypotheses
Hypothesis 1(A): With a relatively tighter command and control structure al
Qaeda will have superior counterintelligence training and compartmentation.
718 It is important to note that the evidence offers examples of potentially exploitable vulnerabilities, as opposed to vulnerabilities that were certainly exploited by al Qaeda’s adversaries. Al Qaeda’s potential vulnerabilities are a purer measure of its counterintelligence deficits, as the vulnerabilities that are actually exploited represent the nexus of the adversaries’ capabilities and the group’s vulnerabilities.
197
Hypothesis 1(B): With a relatively tighter command and control structure al
Qaeda will be more vulnerable to its adversary’s efforts to develop high-level
penetrations and exploit the group’s standardized counterintelligence procedures.
Hypothesis 2(A): With relatively greater popular support al Qaeda will have
greater counterintelligence support from the local population.
Hypothesis 2(B): With relatively greater popular support al Qaeda will be more
likely to expose itself in its efforts to maintain popular support.
Hypothesis 3(A): With relatively more controlled territory al Qaeda will have
superior communications security, physical security and counterintelligence vetting.
Hypothesis 3(B): With relatively more controlled territory al Qaeda will be more
vulnerable to its adversary’s efforts to track the group’s gross financial, logistical and
personnel movements.
Hypothesis 4: Al Qaeda will become increasing centralized and tightly
commanded over time in the face of external threats.
Alternative and Falsifiable Hypotheses
The alternative hypotheses argue the opposite of the core hypotheses. Thus, the
first alternative hypothesis is that tighter organizational structure will not produce
superior counterintelligence training and compartmentation or greater vulnerabilities to
high-level penetrations. Conversely, if the group has a loose organizational structure but
does not suffer from inferior counterintelligence training and compartmentation, then the
alternative hypothesis is correct and the core hypothesis is falsified.
198
The second alternative hypothesis is that popular support will not result in greater
counterintelligence support from the local population or greater vulnerability to exposure
in the media. Thus, if the group wages a popular support campaign but does not induce
counterintelligence vulnerabilities as a result and does not benefit from increased local
support, then the alternative hypothesis is correct and the core hypothesis is falsified.
The third alternative hypothesis is that controlled territory will not result in
greater physical and communications security or greater vulnerabilities to tracking the
group’s gross movements of personnel and logistics. Thus, if the group operates from
controlled territory but does not benefit from more secure communications and vetting,
then the alternative hypothesis is correct and the core hypothesis is falsified.
The fourth alternative hypothesis is that a terrorist group facing an increasing
menacing adversary will not become more centralized and tightly commanded over time.
Thus, if the group faces an increasing threat from its adversary but does not centralize its
decision-making and tighten its command and control, then the alternative hypothesis is
correct and the core hypothesis is falsified.
Control Variables: Alternative Explanations
Some control variables do not remain perfectly constant in the al Qaeda case
study, opening up the possibility that the control variables account for some of the change
in the dependent variables. Al Qaeda’s resources remain relatively constant and therefore
are unlikely to be the cause of variations in counterintelligence strengths and
vulnerabilities. Al Qaeda’s adversaries’ strength, however, shifted from low to high from
period one to two, which may account for the counterintelligence deficiencies al Qaeda
199
accrued in period two. For example, the counterintelligence setbacks associated with
campaigning for popular support in period two may result from having a more capable
adversary.
Additionally, al Qaeda almost certainly experienced organizational learning over
the three periods, which may account for a variety of improvements in its
counterintelligence capabilities. For example, al Qaeda’s ability to gain more
counterintelligence support from the local population over time may result from normal
organizational learning rather than shifts in al Qaeda’s popular support.
Al Qaeda Case Study: Dependent Variables
Al Qaeda
Adversary CT
Capability
Org Structure
Resources
Controlled Territory
Popular Support Type
1988 - 1996 Low Low High Yes Low 11
1996 - 2001 High Tight High Yes Low 4
2001 - 2003 High Medium High Yes High 8
Al Qaeda: Background
Al Qaeda formed in 1988, after the war between the USSR and Muslim fighters in
Afghanistan ended. Osama Bin Laden, a financier and fighter in the Afghan insurgency,
200
created al Qaeda to continue the struggle to drive non-Islamic powers out of the Middle
East. Roughly a dozen individuals pledged their allegiance to Bin Laden and al Qaeda in
1989 and many individuals traveled to the Balkans, Somalia, and Chechnya to continue
what they viewed as a global jihad. Bin Laden established al Qaeda’s headquarters in
Khartoum, Sudan in 1991 until the group was forced to leave in 1996.
Al Qaeda Timeline: 1988 – 1996
Al Qaeda: 1988 – 1996
Adversary Counterterrorism Capability. From its beginnings in 1988, al Qaeda
faced capable adversaries. In this first period, however, its adversaries did not always
take aggressive military action against the group. The United States, one of al Qaeda’s
most powerful adversaries, relied mainly on non-military counterterrorism measures to
keep the group in check after it established itself in Sudan in 1991.
1988: Al Qaeda founded
1991: US Forces fight the first Gulf War, based out of Saudi Arabia
1991: Al Qaeda moves to Sudan
1993: Sudan Designated as a state sponsor of terrorism
1994: Assassination attempt against Bin Ladin in Khartoum
1994: Al Qaeda Establishes the Advice and Reform Committee based in London
1996: Al Qaeda expelled from Sudan and relocates to Afghanistan
201
First, the US pressured Sudan to expel several terrorist groups, including al
Qaeda.719 The governments of Egypt, Syria, Jordan, and Libya also pressured Sudan to
cut off its support to al Qaeda. In 1993, the US designated Sudan a state sponsor of
terrorism and placed Bin Laden on a terrorist watch list, which prevented him from
obtaining a visa to enter the United States.720 Though US counterterrorism authorities
were trying to keep track of Bin Laden’s activities, they considered him an extremist
financier, rather than a terrorist.721 International pressure on Sudan continued to mount
until the Sudanese government forced Bin Laden and al Qaeda to move its headquarters
out of the country in 1996. Meanwhile, preparations for al Qaeda’s earliest terrorist
operations in Saudi Arabia, Kenya and Tanzania continued undetected, as the US
authorities had limited motivation to gather counterterrorism intelligence in these
locations.722
Organizational Structure. Al Qaeda’s organizational structure in the 1988 to
1996 period was relatively hierarchical and tightly commanded and managed.723 Bin
Laden was the group’s first leader in 1988, commanding the group’s intelligence branch,
a military committee, a financial committee, a political committee, a media committee,
719 The 9/11 Commission Report, Final Report of the National Commission on Terrorist Attacks Upon the United States, Thomas H. Kean, Chair, August 21, 2004, 62. 720 Ibid, 109. 721 Ibid, 109. 722 Brian Michael Jenkins, Countering Al Qaeda, (Santa Monica, CA: RAND, 2002), 6. 723 For the purpose of this chapter, Al Qaeda is defined as the Bin Ladin, his advisors and deputies, individuals pledging allegiance (bayat) to Bin Ladin or to his deputies, and individuals using this core group’s funding and training to conduct attacks in the name of Al Qaeda.
202
and the Advisory Council that comprised Bin Laden’s inner circle.724 The Advisory
Council had between seven and ten members who advised Bin Laden on operational
goals and political considerations and were considered the highest authority in al Qaeda
after Bin Laden and his deputy.725
Resources: Local. Al Qaeda had access to money, high quality personnel and
controlled territory in this early period. Bin Laden’s confidant Ayman al-Zawahiri
brought with him a cadre of highly-disciplined Egyptian fighters.726 His recruits were
doctors, engineers and soldiers, and many were used to working in secret.727 These men
joined recruits from the large pool of Arab Afghans left over from the war against the
Soviets.728 From the minutes of al Qaeda’s first meeting in August 1988, al Qaeda’s
leaders were planning to have 314 militants trained by mid-1989.729
In 1988, Zawahiri and Egyptian Islamic Jihad leader Sayyid Imam al Sharif, aka
Dr. Fadl, established the Farouk Camp near Khost, Afghanistan to recruit and train elite
fighters that would become part of al Qaeda.730 The group had enough money in this
724 The 9/11 Commission Report, 56. 725 Combating Terrorism Center Department of Social Sciences United States Military Academy, Harmony and Disharmony Exploiting al-Qa’ida’s Organizational Vulnerabilities, Document: AFGP-2002-000080. 726 Lawrence Wright, The Looming Tower: Al-Qaeda and the Road to 9/11, (Alfred Knopf: New York, 2006), 128. 727 Ibid, 128. 728 Wright, 133. 729 Peter L. Bergen, The Osama bin Ladin I Know: An Oral History of the al Qaeda Leader, (Free Press: New York, 2006) 79. 730 Wright, 141.
203
period to pay its married members $1,500 per month and its single members $1,000 per
month.731
Sudan provided al Qaeda with territory and safehaven. In 1990, Hassan 'Abd
Allah al-Turabi, leader of the National Islamic Front political party in Sudan, invited Bin
Laden to use Sudan as a safehaven after he was expelled from Saudi Arabia in 1991.732
Turabi then dispatched Sudanese intelligence officers to meet with Bin Laden and
facilitate his move to Sudan.733 Sudan was an ideal terrorist territory. The border with
Egypt was largely unguarded and Islamic militants from all over the Middle East, and
Egypt, Pakistan and Afghanistan in particular, had used Sudanese territory for terrorist
training since the mid 1980s.734
In 1989, Sayf al-Adl, a high-ranking member of al Qaeda and a former Egyptian
army officer, purchased two farms in Sudan for al Qaeda military training—one in Port
Sudan for $250,000 and the other near Khartoum for $180,000.735 Turabi provided al
Qaeda with 200 passports and semi-official status, allowing group members to travel
outside of Sudan with relative ease under alias identities.736 Sudan also allowed foreign
militants to enter the country. By 1993, young men from many countries were traveling
to al Qaeda’s Soba Farm, ten kilometers south of Khartoum, to meet Bin Laden and begin
731 Ibid, 142. 732 Coll, 267. 733 Wright, 164. 734 Jason Burke, Casting a Shadow of Terror, (I.B. Taurus: London, 2003), 130. 735 Bergen (2006), 121. ; Bergen (2001), 82. 736 Jane Corbin, Al-Qaeda: In Search of the Terror Network that Threatens the World, (Thunder’s Mouth Press: New York, 2003), 55.
204
their terrorist training.737 Bin Laden paid for 480 Islamic fighters to move from Pakistan
to Khartoum in the spring of 1993.738
An officer in the Sudanese army, Muqadem Abdul Basit Hamza, supplied al
Qaeda with a system of radios for internal communications.739 During this period, Bin
Laden also had access to a satellite phone.740 Even when Sudan expelled al Qaeda in
1996, the Sudanese intelligence service tasked its Peshawar station with scouting out a
suitable new base for Bin Laden in Afghanistan.741
Al Qaeda received support from other militant groups as well. In 1991, al Qaeda
was still relatively small and occasionally relied on the expertise and resources of more
established militant groups, such as Egyptian Islamic Jihad.742 Sometime between 1991
and 1993, veterans of the Afghan war compiled the Encyclopedia of Jihad, an eleven-
volume collection of the terrorist and guerrilla tactics, which al Qaeda used to improve its
operational tradecraft.743
Resources: International. Al Qaeda has access to an international recruiting
network in this early phase. Mosques and schools throughout the world that served as
recruiting stations for the Afghan war continued to attract radical Islamic militants.744 Bin
Laden was also familiar with the global recruitment strategies and logistics, as he had
737 Wright, 187. 738 Coll, 268. 739 US v. UBL et al., United States District Court Southern District of New York, S(7) 98 Cr. 1023, 2. 740 Ibid, 2. 741 Burke, 142. 742 Burke, 9. 743 Ibid, 9. 744 The 9/11 Commission Report, 55.
205
helped to set up the Mektab al Khidmat, aka the Bureau of Services, which channeled
recruits into Afghanistan in the 1980s.745 However, al Qaeda had not yet gained
international notoriety nor was it able to use its name recognition to draw recruits to its
cause.
Al Qaeda had access to money in this period, though not the $300 million Bin
Laden fortune as some analysts have claimed. The Saudi government froze Osama Bin
Laden’s assets and forced his family to share his portion of the company, so Bin Laden
probably had access to only $30 million in Sudan.746
Al Qaeda’s international recruits reflected its global ambitions. Many al Qaeda
members settled in Sudan in part because they could not return to their home countries,
particularly Egypt, Algeria, Libya, Syria, and Iraq, for fear of government persecution.747
Though al Qaeda was headquartered in Sudan, it retained training camps in Afghanistan
and had members training in Bosnia, Yemen, and the Philippines.748
One of al Qaeda’s most important early resources was a former Egyptian military
officer, Ali Adbelseoud Mohammed, aka Abu Omar. Abu Omar served in the Egyptian
military from 1971 to 1984 where he received special forces and intelligence training.
Abu Omar worked for Egyptian Airlines from 1984 to 1986 as a counterterrorism
specialist. In 1986, Abu Omar emigrated to the US, enlisted in the US Army and was
745 Ibid. 746 Staff Report of the National Commission on Terrorist Attacks Upon the United States, “Monograph on Terrorist Financing,” 20. 747 Bergen (2006) 107. 748 Marc Sageman, Understanding Terror Networks, (University of Pennsylvania Press: Philadelphia, 2004), 44.
206
assigned to the John F. Kennedy Special Warfare School.749 Abu Omar stole and
translated US military training manuals into Arabic and used his knowledge of special
warfare and intelligence to train al Qaeda fighters.750 Al Qaeda’s manuals were probably
important for the group as many operatives were apprehended in possession of these
materials. For example, in 1993 an operative involved in the first attack against the
World Trade Center was detained at JKF airport with a bag full of al Qaeda terrorist
training manuals.751
In this early phase, al Qaeda was already using its international resources to
prepare for the Embassy bombings attacks that would occur in 1998. In 1994, al Qaeda
cells were setting up in Nairobi and Mombasa and preparing the initial phases of
surveillance for the Embassy attacks.752
Popular Support: Local. Al Qaeda did not enjoy a significant amount of local
popular support in Sudan in the 1988 to 1996 period. This is mostly because Bin Laden
was able to purchase or otherwise win the loyalty of the Sudanese government. Since the
government allowed Bin Laden to set up al Qaeda’s headquarters and camps in Sudan,
there was not a pressing need to develop local popular support.
749 US v. Ali Abdelseoud Mohamed, Sworn Affidavit of FBI Special Agent Daniel Coleman, Sept 1998. 750 Ibid. 751 Burke, 9. 752 Rohan Gunaratna, Inside Al Qaeda: Global Network of Terror, (Columbia University Press: New York: 2002), 159.
207
Bin Laden cultivated relationships with Sudan’s business community, political
leadership, and intelligence and military communities. Bin Laden became close to
Turabi, Sudan’s president Omar al-Bashir and to some government ministers.753
Support for al Qaeda among the general Sudanese population was limited, though
not completely absent, in this period. Some of this popularity was directed at Bin Laden
as an individual. Bin Laden fought alongside Arabs and Afghans in the trenches of
Afghanistan and became respected and renowned for such bravery.754 Bin Laden also
held regular lectures at his guesthouse and mosques in Khartoum, where group members
and recruits could hear Bin Laden speak about jihad and al Qaeda.755
Al Qaeda did not embrace the terrorist image during this period and forbade its
members from claiming credit for attacks or publicly identifying the organization for fear
of drawing attention from its adversaries.756
Al Qaeda’s lack of popular support and dependence on Sudan ultimately
backfired on the group. Sudan was under constant pressure from the US, Egypt and Saudi
Arabia to expel Bin Laden. The fact that the Sudanese public would not react violently to
al Qaeda’s expulsion gave the government leverage over al Qaeda.757 President al-Bashir
came under increased international pressure to expel Bin Ladin in 1996, but did not face a
countervailing local pressure demanding Bin Ladin’s protection. The President believed
that he would not be able to win the US’s favor or investment dollars as long as Bin
753 Ibid 32. 754 Bergen (2006) 55. 755 Coll, 269. 756 Gunaratna, 35. 757 Bergen (2006), 155.
208
Laden was in Khartoum.758 As a result, Bashir informed Bin Ladin that al Qaeda needed
to move from Sudan in 1996.
Popular Support: International. From its inception, al Qaeda attempted to inspire
the ‘feeling of jihad’ on a global scale.759 The group was partially successful in this
endeavor in the 1988 to 1996 period.
Bin Laden came to al Qaeda with experience in media and propaganda, having
run the Office of Services with Abdullah Azzam. Beginning in 1984, the Office of
Services published Jihad magazine, which provided a monthly assessment of the war in
Afghanistan and focused on how Arabs contributed to the struggle against the Soviets.760
Bin Laden distinguished al Qaeda’s philosophy from those of its militant cohorts by
focusing on overthrowing governments in the Muslim world that were deemed
‘apostate’.761 Al Qaeda members began to meet at Bin Laden’s residence in Peshawar in
the late 1980s and invited journalists and relief agencies to put Bin Laden and al Qaeda in
the media spotlight.762
Bin Laden carefully managed his public persona, commissioning documentaries
of his life in Afghanistan in 1988, which showed him eating poor food and living in caves
in the Afghan hills. Bin Laden funded a newspaper in Pakistan and cultivated influential
journalists.763 Bin Laden became close to Saudi Arabian journalist Jamal Khashoggi, for
758 Coll, 324. 759 Harmony and Disharmony Exploiting al-Qa’ida’s Organizational Vulnerabilities, Document: AFGP-2002-000080. 760 Bergen (2006), 32. 761 Bergen (2006), 74. 762 Ibid, 83. 763 Burke, 75.
209
example, who wrote about Bin Laden’s exploits in Afghanistan and took the first
published photograph of the al Qaeda leader.764 Al Qaeda’s media committee started a
weekly newspaper called Nashrat al Akhbar and established a media liaison wing in
1994, known as the Advice and Reformation Committee (ARC), based in London.765
Bin Laden loyalist Khaled al-Fawwaz moved from Sudan to London in 1994 to
establish and manage the ARC. Fawwaz began disseminating al Qaeda condemnations
of the Saudi and US governments.766 Bin Laden’s hatred for the Saudi regime and US
increased dramatically in the early 1990s when the US military based itself in Saudi
Arabia to fight the 1991 Gulf War.767 Bin Laden’s vitriolic attacks on the Saudi regime
increased his popularity among Muslim youths throughout the Arab world and earned
him the moniker Sheikh Osama.768
Bin Laden granted an interview to TIME magazine correspondent Scott MacLeod
in May 1996 in Khartoum, probably to combat his emerging ‘terrorist’ image in the
popular media. Bin Laden argued that he was a simple businessman who was working
nonviolently to reform the Saudi regime.769 At the time, however, US authorities
suspected Bin Laden had played a role in the bombing of a US-run National Guard
training center in Riyadh, Saudi Arabia.
764 Wright, 199. 765 Bergen (2006), 87. / Burke, 158. 766 Abdel Bari Atwan, The Secret History of al Qaida (Saqi Books: London, 2006), 15. / Corbin, 57. 767 Christopher M. Blanchard, “Al Qaeda: Statements and Evolving Ideology,” Congressional Research Service, Order Code RS21973, November 16, 2004, 2. 768 Bergen (2006), 150. 769 Ibid, 134.
210
Bin Laden changed his rhetoric after being expelled from Sudan, issuing his first
declaration of jihad against the US in 1996, via the London-based newspaper Al Quds Al
Arabia.770
Intelligence: Local and International. Al Qaeda’s intelligence capabilities were
limited in this period, primarily because the group was just beginning its intelligence
activities to support planned terrorist operations.
In Sudan, al Qaeda was using a relatively sophisticated, hand-held radio system to
pass information between the group’s ‘officers’.771 The radios were provided to al Qaeda
by the Sudanese military. In 1992, Abu Omar was training al Qaeda members in
surveillance and intelligence gathering techniques.772 Portuguese al Qaeda member
Paulo Jose de Almeida Santos, aka Abdullah Yusuf, asserted in 2002 that he was part of
an al Qaeda open source intelligence group that provided political analysis to al Qaeda
leaders based on newspaper articles.773
Outside of Sudan, al Qaeda intelligence efforts were gathering steam. Zawahiri
had tasked Abu Omar to penetrate US intelligence in the early 1990s. Abu Omar used
his access to the Special Warfare Center at Fort Bragg to steal training manuals and then
downsize and copy them at Kinkos.774
770 It is not exactly clear why Bin Ladin was motivated to change al Qaeda’s rhetoric at this point. 771 US v. UBL et al., 4. 772 Burke, 95. 773 Bergen (2006), 118. 774 Wright, 181.
211
In 1993, Bin Laden sent Muhammed Atef, one of his top military commanders at
the time, to Somalia to determine how best to attack US forces based there.775 Atef
reported back to Sudan and al Qaeda dispatched a mortar specialist to Somalia. Atef also
returned to provide military training and assistance to Somalis fighting against US
forces.776
In the mid-1990s, Bin Laden dispatched Abu Omar to Nairobi to surveil targets
for the upcoming Embassy attacks. Abu Omar surveilled the French Cultural Center and
the British-owned Norfolk Hotel, as well as the Embassy of Israel and the Israeli El Al
Airline office—though he determined that the Israeli targets were too heavily fortified to
be attacked.777 Abu Omar carried several cameras as he surveilled the US Embassy and
noted traffic patterns, the rotation of security guards, and the location of closed circuit
television cameras. He developed the photographs himself, drafted a plan of attack on his
Apple PowerBook 140 and then made his presentation to Bin Laden in Khartoum.778
Counterintelligence: Local. Though al Qaeda faced few major security threats in
the 1988 to 1996 period the group gave some thought to counterintelligence procedures.
Some of al Qaeda’s counterintelligence awareness was a product of the guerrilla
fighting and ‘underground’ experience of its members. Zawahiri, for example, led a
775 Bergen (2001), 85. 776 Ibid. 777 Ibid, 198. 778 Ibid.
212
clandestine underground organization in Egypt before he was sixteen and spent years
evading Egyptian security services.779
Zawahiri’s security consciousness was evident when he met Bin Laden in 1988.
Bin Laden was giving a lecture on boycotting American goods and Zawahiri warned Bin
Laden that he was provoking a powerful enemy and advised him to increase his security
posture.780 The Egyptian recruits that Zawahiri brought to al Qaeda were also security
conscious and many were used to working in secret.781
Al Qaeda received direct and indirect counterintelligence support from the
Sudanese government. Al Qaeda trainers showed recruits how to create false passports
and alter documents while Sudan provided the group with hundreds of passports.782
Sudanese intelligence provided perimeter security for Bin Laden while his personal
bodyguards provided close proximity security.783
In return for Sudan’s support, al Qaeda provided Sudan with counterintelligence
support. As early as 1992, al Qaeda members were tasked to the Sudanese intelligence
service’s ‘Delegation Office’ where people coming into Sudan were interviewed and
given a background check to make sure they were not a threat to Sudan.784 As a
byproduct, al Qaeda’s service in the Delegation Office provided the group with valuable
intelligence on who was coming into Sudan.
779 Montasser Al-Zayyat, The Road to Al-Qaeda: The Story of bin Ladin’s Right Hand Man, (Pluto Press: London, 2004), 18. 780 Wright, 127. 781 Ibid, 128. 782 Corbin, 40. 783 US v. Ali Abdelseoud Mohamed, Sworn Affidavit of FBI Special Agent Daniel Coleman, Sept 1998.. 784 US v. UBL et al., Day 2. / Gunaratna, 32.
213
Bin Laden and his top officers also gave thought to physical and personnel
security. Bin Laden employed guards to watch his house in Khartoum and accompany
him when he left the capital. He also required his chief of security to secure the
guesthouses and farms where he stayed.785 Bin Laden also kept a database of each al
Qaeda member, where he stored information about their families, their aliases, how much
money they made for al Qaeda, and whether they participated in military operations. Bin
Laden used these files to determine which individuals were best suited for a particular
task.786
Communications security was also important to the group. Jamal Ahmed al-Fadl,
a Sudanese member of al Qaeda, testified during the US Embassy bombings trial that al
Qaeda relied on radio-based communications because they considered radio
communications to be more secure than telephones.787
Al Qaeda had some counterespionage abilities in this period, though it wasn’t
systematic or sophisticated. Through its work in the Delegation Office, al Qaeda could
monitor specific threats to the group and vet recruits who were coming into Sudan to join
al Qaeda.788 Jamal al-Fadl, as chief of security for Bin Laden, was responsible for
checking individuals who were meeting with Bin Laden.789
785 Bergen (2006), 133. / US v. UBL et al., Day 7. 786 Gunaratna, 33. 787 US v. UBL et al., Day 2. 788 Ibid, Day 7. 789 Ibid, Day 7.
214
Al Qaeda relied partially on kinship and trusted referrals to recruit and vet new
members.790 According to the minutes from one of al Qaeda’s first meeting in August
1988, one requirement for entering the group was a referral from a trusted source.791
Egyptian members of al Qaeda were tasked with screening new recruits in their first few
weeks of training, but this screening was probably designed to assess their skill and
intelligence rather than their trustworthiness.792
Al Qaeda experienced several counterintelligence setbacks in this period. First, al
Qaeda suffered two major espionage cases. The most damaging was al-Fadl, one of Bin
Laden’s most trusted aids, who was caught stealing money from al Qaeda in 1995. When
Bin Laden confronted al-Fadl, he decided to leave al Qaeda rather than return the money,
and then sold al Qaeda information to a variety of intelligence services in the Middle
East.793 US officials first encountered al-Fadl at the American Embassy in Eritria in 1996
where he became an FBI informant and eventually a key witness in the US Embassy
bombings trial.
A second espionage case was L’Houssaine Kherchtou, one of Bin Laden’s
personal pilots. Kherchtou turned on al Qaeda after Bin Laden refused to give him $500
for his wife’s Caesarean section.794 Al Qaeda caught at least three other informants in
790 Wright, 192. 791 Bergen (2006), 81. 792 Ibid, 84. 793 Wright, 197. 794 Ibid, 197.
215
this period and sent two of them to prison and executed the third, according to al-Fadl’s
testimony at the US Embassy bombing trials.795
Bin Laden also had at least one serious security breach where he was nearly
assassinated. In 1994, the assassins, led by a Libyan, sped by Bin Laden’s Khartoum
residence and raked the building with machine gunfire.796 In response, Bin Laden made
several renovations to his security protocol. First, he tasked Abu Omar with training an
elite force of bodyguards to protect him around the clock. Egyptian made up most of Bin
Laden’s inner ring of bodyguards, probably to ensure greater loyalty or control.797
Interestingly, Bin Laden relied on nationality to some extent for vetting. Sudanese
intelligence personnel provided perimeter security at his Khartoum home alongside
additional armed guards and road blocks to prevent traffic from passing too close to the
compound.798
Another counterintelligence vulnerability for Bin Laden was his large family.
When he moved to Sudan in 1992, he brought his four wives and seventeen children with
him.799 This left a large footprint whenever he traveling with his family and also gave an
adversary’s intelligence service more individuals to target for surveillance or even
recruitment.
The final counterintelligence vulnerability was al Qaeda’s closeness to its state
sponsor, Sudan. Sudan had the ability to compel al Qaeda to act in ways that made the
795 US v. UBL et al., Day 2. 796 Peter Bergen, “The Long Hunt for Osama,” The Atlantic Monthly, October 2004. 797 Wright, 193. 798 Bergen (2006), 136 – 143. 799 Wright, 165.
216
group more vulnerable. For example, al Qaeda was forced to expel its Libyan members
when Sudan promised the Libyan Government that it would cease providing sanctuary to
enemies of Libya—a move that angered the Libyan al Qaeda members and prompted
them to renounce their connections to Bin Laden.800
Sudanese officials, and its intelligence service in particular, also knew a great deal
about al Qaeda’s modus operandi, personnel, resources and plans. In 1996, Sudan
allegedly offered to give the US its intelligence files on al Qaeda, with details of the
groups personnel and networks, in exchange for better diplomatic and economic
relations.801 Sudan may or may not have been prepared to give the US such damaging
information. Regardless, an able adversary would only have needed to penetrate the
Sudanese intelligence service, or perhaps a Sudanese military or law enforcement entity,
in order to access sensitive information about al Qaeda’s personnel, plans, and networks.
Counterintelligence: International. Though al Qaeda had a counterintelligence
capability in this period, it was not systematic or sophisticated.
The al Qaeda cell in Nairobi was aware of its counterintelligence vulnerabilities,
in some cases to the point of extreme paranoia. Cell manager Harun Fazul faxed a report
to American al Qaeda member Wadi al-Hage warning that the cell members in East
Africa were probably under telephonic and physical surveillance by agents of the US,
Egyptian and Kenyan governments.802
800 The 9/11 Commission Report, 62. 801 Corbin, 62. 802 The 9/11 Commission Report, 3. / Frontline: http://www.pbs.org/wgbh/pages/frontline/shows/binladen/upclose/computer.html
217
In addition to being aware of its counterintelligence weaknesses, al Qaeda also
appreciated the vulnerabilities of its adversaries. From its inception, al Qaeda was
interested in recruiting individuals who carried US passports.803 Al Qaeda assessed that
individuals with US passports would be given less scrutiny and would raise less suspicion
in their travels.804 Al Qaeda members also used aliases and cover identities.805 Zawahiri
traveled to the US in 1993 to raise money for al Qaeda, traveling under cover as a
Kuwaiti Red Crescent representative with the alias Dr. Abdul Mu’iz.806 Al Qaeda
advised some of its members to carry cigarettes and cologne in their travel bags in case
they were questioned and searched by customs officers.807 Though this strategy is fairly
unsophisticated and easily detected, it was probably sufficient at the time to avoid
attracting scrutiny.
Al Qaeda had additional counterintelligence vulnerabilities in its international
operations in this period. First, al Qaeda did not conduct extensive background checks on
its recruits, but instead relied in part on kinship and friendship ties to determine if
members could be trusted.808 The system of informal ‘vouching’ would later lead to
counterintelligence setbacks for al Qaeda, including the leakage of information by a
husband of one of Bin Ladin’s nieces. Second, al Qaeda members did not always
practice good computer security in Kenya and the Philippines. Police seized al Qaeda
803 US v. Ali Abdelseoud Mohamed, Sworn Affidavit of FBI Special Agent Daniel Coleman, Sept 1998. 804 Ibid. 805 Bergen (2006), 78. 806 Wright, 179. 807 US v. UBL et al., Day 2. 808 Ibid, Day 4.
218
computers in those countries and it is plausible that law enforcement exploited sensitive
information on those hard drives. Keeping sensitive files on computers is probably
unavoidable for a terrorist organization, but the counterintelligence vulnerability comes
from not having a method for hiding or destroying computers and computer files before
the hard drives are seized.
Summary. From its beginnings in 1988, al Qaeda faced powerful adversaries,
though these adversaries were not always militantly proactive against the group. Al
Qaeda had access to a high level of financial resources, high quality personnel, controlled
territory, and an international recruiting network. Al Qaeda did not enjoy a significant
amount of local popular support in Sudan mostly because Bin Laden was able to purchase
the loyalty and protection of the Sudanese government. Al Qaeda attempted to inspire a
global following but was only successful to a limited extent in this endeavor. Al Qaeda’s
intelligence capabilities were also limited. Though al Qaeda had a counterintelligence
capability in this period, it was not systematic or sophisticated. However, al Qaeda’s
relatively tight organizational structure and access to controlled territory allowed it to
train its members and boost its intelligence and counterintelligence capabilities.
Al Qaeda did not have a high level of popular support and therefore did not
convert this goodwill into intelligence and counterintelligence from locals. Al Qaeda
also did not create an overwhelming counterintelligence burden from publicity campaigns
because the group did not focus too heavily on promoting itself in this period.
219
Al Qaeda Timeline: 1996 – 2001
Al Qaeda: 1996 – 2001
Adversary Counterterrorism Capability. Al Qaeda was unique in that it
developed powerful adversaries both in the Middle East and in the West. Al Qaeda
believed that in order to defeat the “near enemies” such as Saudi Arabia and Egypt the
group had to challenge the “far enemies”, such as the US.809
The US was al Qaeda’s most powerful adversary in the 1996 to 2001 period. Bin
Laden issued a declaration of jihad against the US in 1996 after moving from Sudan to
Afghanistan. The US sketched out the first of several plans to seize and detain Bin Laden
in 1997.810 The US mapped out Bin Laden’s Tarnak Farms facility in Kandahar
including the buildings where he was most likely to be sleeping. Working with some
809 Interview with Roger Cressey; Harmony and Disharmony Exploiting al-Qa’ida’s Organizational Vulnerabilities, Document: AFGP-2002-600002. 810 The 9/11 Commission Report, 112.
1996: Al Qaeda declares jihad on the US
1998: US Embassies bombed in Kenya and Tanzania
1998: Bin Laden issues first fatwa
1998: Bin Laden gives KSM the ‘green light’ to conduct 9/11 attacks
1998: US retaliates for Embassy attacks with cruise missile strikes
2000: USS Cole attacked in Yemen
1999: Encyclopedia of Jihad begins circulating in jihadist circles
2001: 9/11 attacks in NYC and Washington, DC
220
local tribal leaders, the US rehearsed the seizure operation in the fall of 1997.811 The US
cancelled the operation, however, after assessing that the tribal personnel would be
unlikely to complete the mission. The US recognized the dangers of the operation:
millions of dollars lost, a bloody shootout that might be made public, and perhaps a
violent backlash among radicals in Pakistan.812
After al Qaeda successfully bombed the US Embassies in East Africa in August
1998, the US once again made plans to strike at al Qaeda’s leaders, this time at a terror
training camp in Khost, Afghanistan. The US initially assessed the strike as worth the
risk, given that the camp was far from civilian population centers and almost certainly
contained Bin Laden and his chief lieutenants.813 US Navy vessels in the Arabian Sea
launched cruise missiles at the targets in Afghanistan but Bin Laden and his lieutenants
survived.814
The US received information in December 1998 that Bin Laden was spending the
night at the governor’s residence in Kandahar. Again, plans were drawn up to strike Bin
Laden with cruise missiles. The plan was shelved, however, after several US officials
expressed concern over the quality of the information and the likelihood of killing or
injuring over 300 bystanders.815
In the fall of 1999, the US increased its counterterrorism efforts against al Qaeda.
The US began a program to hire officers with more counterterrorism skills, recruit more
811 Ibid, 112. 812 Ibid, 114 - 115. 813 The 9/11 Commission Report, 116. 814 Ibid, 117. 815 Ibid, 131.
221
assets, penetrate al Qaeda’s ranks, and continue disruption and rendition operations
worldwide.816 The US also began to increase its contacts with the Northern Alliance
rebels fighting the Taliban in Afghanistan as well as increase signals and imagery
collection against al Qaeda.817
Despite the US assets arrayed against al Qaeda prior to 9/11, US remained
deficient in intelligence on al Qaeda’s top leaders, operational planners and camps. Feroz
Ali Abassi, an al Qaeda member captured in Pakistan after the fall of the Taliban,
asserted that it was common knowledge in the camps just prior to 9/11 that there was a
large imminent operation against a US target. Therefore, he was surprised that there were
no American strikes against al Qaeda camps in Afghanistan before 9/11.818
Organizational Structure. Al Qaeda’s structure in the 1996 to 2001 period
remained relatively hierarchical, though the operatives deployed outside of Afghanistan
retained some operational autonomy. The inner core, which swore loyalty to Bin Laden,
had clearly defined positions and salaries.819 The core in Afghanistan and the al Qaeda
camps were tightly managed. One of al Qaeda’s master recruiters, Abu Zubaydah, kept
files on all the members, made their travel arrangements, assigned them to camps and
assigned them tasks appropriate to their training.820 By the late 1990s, Mohammed Atef,
as known as Abu Hafs al Masri, was al Qaeda’s senior operational planner and
816 Ibid, 142. 817 Ibid, 142. 818 Bergen (2006), 308. 819 The 9/11 Commission Report, 67. 820 Corbin, 79.
222
commanded a group of overseas field commanders with help from al Qaeda member Sayf
al-Adl.
Al Qaeda called this management model the “centralization of decision and
decentralization of execution.”821 Al Qaeda’s leaders would select the targets and
provide funding for the operations in many cases. However, the field commanders would
make the day-to-day decisions about logistics and planning.822 Some have described this
as a terrorist venture capital model, where terrorist entrepreneurs would approach al
Qaeda with ideas for operations and leaders would decide on which ‘projects’ they would
fund.823
Field commanders adopted al Qaeda’s goals and took assignments from Bin
Laden and Atef, but retained operational autonomy in the field and, in some case, did not
swear a formal oath of loyalty to Bin Laden.824 Khalid Sheikh Mohammed (KSM),
Riduan Isamuddin (Hambali), and Abd al Rahim al Nashiri were three such commanders.
KSM proposed the 9/11 operation to Bin Laden sometime in the 1990s, but it wasn’t until
late 1998 that Bin Laden gave KSM the green light to plan and manage the operation.825
KSM, unlike Atef and al-Adl, never formally swore his loyalty to Bin Laden but
nonetheless was given the responsibility to manage al Qaeda’s most ambitious and
elaborate operation.826 While KSM planned and executed the operation Atef and al-Adl
821 Wright, 318. 822 Ibid, 318. 823 Burke, 209. 824 The 9/11 Commission Report, 145. 825 Ibid, 149. 826 Ibid, 150.
223
continued to manage al Qaeda’s worldwide operations.827 KSM managed the operation
with relative autonomy from the al Qaeda leadership and even resisted Bin Laden’s
requests on three occasions to execute the operation ahead of schedule.828
Hambali, considered a lieutenant of Bin Laden in Southeast Asia, was affiliated
with the Indonesian terrorist group Jemaah Islamiyah (JI) and retained a degree of
independence from the al Qaeda leadership in Afghanistan. For example, Hambali
objected when al Qaeda leaders attempted to assign JI fighters to al Qaeda operations
without notifying him.829
Nashiri became a key al Qaeda operations planner in Yemen in 1998 after
proposing a plan to strike a US Navy vessel. Bin Laden directed Nashiri to begin
planning the operation while providing him with al Qaeda recruits and money.830 Nashiri
consulted with Bin Laden before he planned his attacks but selected the recruits and
planned the operation specifics on his own.831
Al Qaeda’s field commanders did not cut themselves off from al Qaeda’s leaders
once operational planning began, however. The al Qaeda cell in Nairobi interacted
regularly with the al Qaeda media branch in London, sent security reports to al Qaeda
headquarters in Afghanistan, and requested secure communications equipment from the
group’s leaders.832 Ziad Jarrah, one of al Qaeda’s 9/11 operatives, visited al Qaeda
827 Interrogation of Khaled Sheikh Mohammed, US v. Mousaoui, Cr. No. 01-455-A, Defendant’s Exhibit 941, 3. 828 Ibid, 31. 829 The 9/11 Commission Report, 152. 830 Ibid, 152. 831 Ibid, 153. 832 US v. UBL et al., Day 20.
224
camps in Afghanistan in 2001 to report to senior leaders and bring back new instructions
for the cells in the US.833
Al Qaeda probably adopted the “decentralization of execution” policy as a result
of the logistical difficulty of commanding operations from Afghanistan and the security
danger of frequent contact between ‘known’ al Qaeda operatives in Afghanistan and
‘unknown’ operatives in cells around the world.834 The group began to remedy its
disconnect with overseas operatives by increasing al Qaeda’s communications and
training presence on the Internet, though it wasn’t until after 9/11 that this strategy was
fully implemented.835
Resources: Local. Al Qaeda’s access to financial resources, high quality
personnel and controlled territory continued in the 1996 to 2001 period. When the group
initially relocated from Sudan to Jalalabad, Afghanistan in 1996, Bin Laden had local
support from warlords in Jalalabad.836 A core of al Qaeda militants traveled with Bin
Laden from Khartoum and though Bin Laden’s bank accounts had been drained the group
received financial backing from wealthy individuals in the Gulf.837
Bin Laden unrooted al Qaeda once more in 1996 and moved the entire group to
Kandahar at the behest of the Taliban.838 The Taliban allowed al Qaeda to open up
terrorist training camps in Kandahar, Khost and Kabul. For a brief time in 1999,
833 Corbin, 180. 834 Burke, 150. 835 Brachman Jarret M. and William F. McCants, Stealing Al-Qa’ida’s Playbook, Combating Terrorism Center at West Point, February 2006, 5. 836 The 9/11 Commission Report, 59. 837 Burke, 151. 838 Ibid, 248.
225
however, the Mes Aynak training camp in Kabul was al Qaeda’s only training facility.839
Al Qaeda trainer Salah al Din complained in this period that the number of recruits in the
camp exceeded the training capacity, but Bin Laden insisted that they all be trained.840
Al Qaeda opened al Faruq camp near Kandahar with the Taliban’s authorization
sometime after 1998. Al Faruq offered advanced terrorist training for select al Qaeda
members. Training included courses on security, intelligence collection,
counterintelligence, and hijacking.841 An even more select group of al Qaeda members
were trained in setting up clandestine cells, planning terrorist operations, and
assassination operations.842 Al Qaeda member Rashed Daoud al-Owhali testified that he
received training in several camps in recruitment, surveillance, counter surveillance, site
surveys, and intelligence collection with video and still photography.843
Before attending these camps, members would have to pass basic training and an
additional guerrilla warfare course that lasted 45 days.844 As a reference, al Qaeda
trainees could access a 180-page manual on weapons training, security and espionage
called Military Studies in the Jihad Against the Tyrants.845
Some recruits could also access videotapes of terrorism and security training
given by al Qaeda member Abu Mousab al Suri. In six videotapes recovered from
Afghanistan after 2001, Suri is viewed in front of a whiteboard addressing a class on how
839 The 9/11 Commission Report, 157. 840 Ibid, 157. 841 Burke, 156. 842 Burke, 157. 843 Mohammad Rashed Daoud Al-Owhali Interrogation, U.S. v Moussaoui Cr. No 01-455-A, Defendant’s Exhibit 767, 5. 844 Wright, 303. 845 Ibid 302.
226
to set up clandestine cells and create contingency plans of their original operation fails.846
Bin Laden was also able to rely on veterans of the Afghan war to serve as trainers in
administrators in al Qaeda camps.847
Resources: International. Al Qaeda’s international resources grew steadily in the
1996 to 2001 period. Though attacks are not an ideal indicator of resources, the
sophistication of al Qaeda attacks in this period, both successful and unsuccessful,
provide some evidence of the group’s extensive resources. The most prominent attacks
were the millennium plots in Amman and Los Angeles Airport in December 1999, the
two attacks against US Navy ships in 1999 and 2000, the Christmas Eve bombings in
Manila in December 2000, the Christmas market bombing plot in Germany in December
2000, and the 9/11 attacks.848 These attacks required well-forged documents, trained and
dedicated operatives, well-oiled logistical networks, and relatively large amounts of cash.
Perhaps the group’s most impressive resource was the number of individuals it
trained between 1996 and 2001. In this period, tens of thousands of individuals are
estimated to have visited al Qaeda training camps in Afghanistan.849 Bin Laden’s
reputation was an important factor in drawing militants to Afghanistan. Journalist Peter
Bergen argues that, “something of a bin Laden cult was taking shape in [this] period”
which “helped fuel an unprecedented volume of recruits to al Qaeda’s camps.”850 Al
Qaeda’s rhetoric about attacking the US, coupled with its success in attacking US
846 Bergen (2006), 245. 847 Burke, 13. 848 Sageman, 48. 849 Burke, 5 / Wright, 302. 850 Bergen (2006), 258.
227
diplomatic and military assets in the late 1990s, spurred its legendary status in the Islamic
world.851
Al Qaeda suffered some financial setbacks following its move to Afghanistan in
1996. Bin Laden lost a number of his businesses after their connection to Bin Laden was
leaked to the Saudi Arabian government.852 However, al Qaeda continued to rely on its
network of wealthy financiers from Saudi Arabia, the UAE, Kuwait and the Persian Gulf,
known as the “Golden Chain”, for donations that were collected via charities,
nongovernmental organizations, and front companies.853
The US government estimated that it cost al Qaeda $30 million per year to sustain
its activities in this period, almost all of which was raised through donations.854 Fund-
raisers for al Qaeda used banks to store and transfer their money, which was most likely
facilitated by corrupt individuals working at these banks as well as by lax regulation at
banks in UAE and Pakistan.855 Though operations were generally cheap—the 1998
Embassy bombings cost around $10,000 and the elaborate 9/11 attacks cost around
$500,000—the group also had the overhead costs of maintaining camps, recruiting, and
evaluating members.856
After moving to Afghanistan in 1996, al Qaeda began to use hawala banking
networks more extensively, in part because Afghanistan’s primitive banking sector did
851 Burke, 152. 852 Atwan, 53. 853 The 9/11 Commission Report, 55. / Gunaratna, 62. 854 Ibid, 170. 855 Staff Report of the National Commission on Terrorist Attacks Upon the United States, “Monograph on Terrorist Financing,” 26. 856 Ibid, 28.
228
not provide al Qaeda with many alternatives. Hawala banking also allowed al Qaeda to
move its finances without government scrutiny or a paper trail of financial transactions.857
Al Qaeda relied on logistical support networks outside of Afghanistan as well.
Support networks in Europe provided assistance in several operations. A Dublin-based
charity gave material support to the al Qaeda operatives involved in the US Embassy
bombings in East Africa.858 The al Qaeda operatives that assassinated Ahmed Shah
Massoud received forged document assistance from a European cell.859 The Hamburg
cell of the 9/11 operation relied on logistical and communications resources provided to
them, sometimes unwittingly, by local Germans.860 Al Qaeda’s network in Yemen
assisted al Qaeda operatives with transportation and logistical support.861
Al Qaeda operatives overseas were also using training manuals, such as the
Encyclopedia of Jihad, to aid them in tradecraft and terrorist operations. The 7000-page
Encyclopedia of Jihad was allegedly transferred to computer disk in the mid-1990s and
was circulating widely in radical Islamic circles by 1999.862 The Jordanian al Qaeda
members captured before they could conduct their millennium terrorist attack in
December 1999 carried with them an al Qaeda training manual on CD-ROM.863
Al Qaeda also benefited from its connections to jihadist terrorist groups
throughout the world. The group’s connection to Jemaah Islamiyah (JI) was one of its 857 Ibid, 25. 858 Lorenzo Vidino, Al Qaeda in Europe: The New Battleground of International Jihad, (Prometheus Books: New York, 2006), 81. 859 Ibid, 81. 860 Corbin, 150. 861 Gunaratna, 140. 862 Burke, 189. 863 Wright, 297.
229
most fruitful relationships. For example, when Mohammed Atef needed someone to head
up al Qaeda’s biological weapons program, Hambali introduced a US-educated JI
scientist, Yazid Sufaat, to Zawahiri in Kandahar in 2001.864 Sufaat spent several months
in 2001 serving in an al Qaeda biological weapons laboratory near the Kandahar
airport.865
Popular Support: Local. Al Qaeda’s local popular support in the 1996 to 2001
remained relatively low. The group relied on the strategy of purchasing the loyalty of
local leaders rather than campaigning to win the hearts of the local population. Though al
Qaeda developed very close ties to the Taliban, relations between the two were not close
initially.
When al Qaeda arrived in Jalalabad in 1996 the area was controlled by a regional
council of Pashtun tribal leaders and former guerrillas.866 Al Qaeda had not yet
developed a relationship with the Taliban and the two groups were probably not
cooperating at this time.867 In 1997, Taliban chief Mullah Mohammed Omar asked al
Qaeda to move from Jalalabad to Taliban-controlled Kandahar, probably to keep a closer
watch on Bin Laden.868
Al Qaeda’s relationship with the Taliban grew increasingly important for both
parties—al Qaeda supplied the Taliban with funds and guerrillas while the Taliban
provided al Qaeda with a safehaven within which to establish controlled territory. US
864 The 9/11 Commission Report, 151. 865 Ibid, 151. / Interrogation of Khaled Sheikh Mohammed, US v. Mousaoui, Cr. No. 01-455-A, Defendant’s Exhibit 941, 51. 866 Bergen (2006), 159 / Coll, 327. 867 Coll, 328. / Byman (2005), 199. 868 Burke, 164.
230
officials estimate that al Qaeda was supplying $10-$20 million per year to the Taliban.869
The group also provided the Taliban with Arab fighters fresh out of al Qaeda training
camps, which the Taliban used to fight its war against Ahmed Shah Massoud’s Northern
Alliance.870 Al Qaeda developed a special guerrilla unit, Brigade 055, dedicated
specifically to helping the Taliban fight the Northern Alliance.871
Al Qaeda reaped some indirect popular support as a result of its association with
the Taliban. The Taliban originated as a small vigilante militia in Kandahar in 1994 and
slowly developed the support of powerful Durrani Pashtun traders and cheiftans.872 As
the Taliban consolidated control over and brought order to Afghanistan it gained
legitimacy and popular support.873 By September 2001, the Taliban controlled about
ninety percent of Afghanistan.874
Al Qaeda relations with the Taliban were occasionally rocky. Al Qaeda
frequently angered the Taliban with its publicity campaigns, as the campaigns brought
negative international attention to the Taliban’s role in providing safehaven to the group.
Mullah Omar requested that Bin Laden halt his international media campaign in 1996 and
Bin Laden agreed to remain silent. However, in 1998 Bin Laden issued a second fatwa
and held numerous press conferences.875 The Taliban became internally divided about
how to deal with al Qaeda’s provocative media strategy. Some Taliban officials,
869 The 9/11 Commission Report, 171. 870 Bergen (2006), 161. 871 Gunaratna, 40. 872 Coll, 285. 873 Bergen (2006), 160. 874 Byman (2005), 194. 875 Wright, 262.
231
including the Foreign Minister Wakil Muttawakil, wanted to expel Bin Laden from
Afghanistan while officials, such as Mullah Omar, strongly opposed expelling the
group.876
The US Embassy bombings led to a US cruise missile attack on Afghanistan in
August 1998 and further taxed the patience of some elements of the Taliban.877 For other
elements of the Taliban, the US attacks in 1998 brought them even closer to al Qaeda and
Bin Ladin. Bin Laden again antagonized some Taliban officials by giving an
inflammatory interview to Al Jazeera’s bureau chief in Pakistan in December 1998.878
Al Qaeda also had internal debates about the merits of a media campaign that
could potentially get them expelled from Afghanistan. In an internal al Qaeda memo
from 1999, two Syrian members in Kabul considered the downside of a campaign for
popular support: “In short, our brother Abu Abdullah’s [Bin Laden] lastest troublemaking
with the Taliban and the Leader of the Faithful [Mullah Omar] jeopardizes the Arabs, and
the Arab presence, today in all of Afghanistan, for no good reason…The strangest thing I
have heard so far is Abu Abdullah’s saying that he wouldn’t listen to the Leader of the
Faithful when he asked him to stop giving interviews…I think our brother [Bin Laden]
has caught the disease of screens, flashes, fans, and applause.”879
Bin Laden compensated for this antagonism by developing strong personal ties to
Mullah Omar. In the spring of 2001 Bin Laden and Mullah Omar hosted a gathering of
876 Bergen (2006), 219. 877 Burke, 164. 878 Bergen (2006), 241. 879 Alan Cullison, “Inside Al-Qaeda’s Hard Drive,” The Atlantic Monthly, September 2004.
232
Taliban supporters where Bin Laden announced that he had sworn his loyalty and
allegiance to Mullah Omar.880 Ultimately, the Taliban continued to protect Bin Laden
and al Qaeda, alleging that they had lost track of the terrorist leader in Afghanistan,
which was almost certainly untrue.881
Despite al Qaeda’s relative inattention to local popular support beyond that
offered by the Taliban, the group orchestrated some small-scale public support
campaigns. In 1998, Bin Laden circulated hundreds of 100 Pakistani Rupee notes that
featured his face and a satire of an American request for information about him.882
Allegedly, several posters widely available in Pakistan featured Bin Laden riding on a
white horse, according to al Qaeda scholar Rohan Gunaratna, reminding the viewer of the
Prophet Mohammed who rode a white horse into battle.883 Bin Laden had to limit his
‘public’ exposure in the al Qaeda camps, however, due to security concerns, and while
many aspiring jihadists would come to hear him speak probably only a few were allowed
to see him.884
Popular Support: International. Al Qaeda’s international support increased
substantially between 1996 and 2001. The increase is the result of a boost in
inflammatory public statements and a series of successful al Qaeda attacks. The group’s
public communications, including articles, videos, audio tapes and interviews, increased
880 Daniel Benjamin and Steven Simon, The Age of Sacred Terror, (Random House: New York, 2002), 155. 881 Burke, 168. 882 Ibid, 158. 883 Gunaratna, 41. 884 Bergen (2006), 258.
233
from an average of 1.3 per year between 1993 and 1995 to 6.5 a year between 1996 and
2001.885
Beginning in the winter of 1996, al Qaeda made big changes to its media strategy.
Bin Laden began to reach out to international and English-language media to deliver
sermons and warnings.886 In some cases he responded to international media
organizations reaching out to him for interviews.887 Bin Laden considered the shift in al
Qaeda’s media strategy as critical to its success as a international terrorist organization.
Sometime between 1997 and 1998, Bin Laden wrote Mullah Omar a letter where he
stated: “Many international media agencies corresponding with us requesting an
interview with us [al Qaeda]. We believe that this is a good opportunity to make
Muslims aware of what is taking place [in] the land of the two Holy Mosques [Saudi
Arabia] as well as what is happening here in Afghanistan. It is obvious that the media
war in this century is one the strongest methods; in fact, its ratio may reach 90 percent of
the total preparation for the battles.”888 Bin Laden hypothesized that ninety percent of al
Qaeda’s guerrilla campaign was a battle for the hearts of the Muslim world.
Al Qaeda’s message of expelling foreign influence from Muslim lands stayed
constant throughout the 1990s, but its focus on expelling Americans increased. Bin
Laden believed that terrorist groups focused solely on attacking local rulers and Israel did
not go far enough as they missed the opportunity to attack the “head of the snake.”889
885 IntelCenter, “al-Qaeda Attack/Messaging Statistics v.1.0,” 22 August 2003, 10. 886 Coll, 341. 887 Bergen (2006), 426. 888 Ibid, 426. 889 The 9/11 Commission Report, 54.
234
Al Qaeda’s first declaration of jihad against the US came in 1996. Bin Laden
argued in his 1996 decree that the Muslim world was being overrun by an “alliance of
Jews, Christians, and their agents.”890 He issued his first fatwa, or religious edict, on 26
May 1998 claiming that the US made a “clear declaration of war on God, his messenger,
and Muslims.”891 His fatwa announced the formation of “The World Islamic Front for
Jihad against the Jews and Crusaders”, which included al Qaeda, Egyptian Islamic Jihad,
and several other regional Islamic militant groups. The goal of World Jihad was to
encourage Muslims throughout the world to target American civilians and military
personnel.892
Al Qaeda began courting international and English-speaking news organizations
in order to get its message to a wider Muslim audience. Bin Laden granted interviews to
CNN, ABC News, and Al Jazeera.893 Bin Laden instructed the al Qaeda media
representative in London to invite British journalist Robert Fisk and Al Quds al Arabia
journalist Abdel Bari Atwan to Afghanistan to interview the terrorist leader.894 To
impress foreign journalists, al Qaeda would sometimes put on a show to herald Bin
Laden’s arrival for his interviews. In one instance, according to Pakistani journalist
Ismial Khan, Bin Laden arrived in a three-car escort while his bodyguards fired machine
890 Blanchard, 2. 891 Ibid, 3. 892 Ibid, 3. 893 Bergen (2006), 161. 894 Atwan, 16.
235
guns and rocket-propelled grenades into the surrounding hills the moment he stepped out
of the car.895
Al Qaeda’s tactical interaction with its international media contacts also became
more sophisticated in the 1996 to 2001 period. Bin Laden’s February 1998 fatwa had
been dictated over a satellite phone to Fawwaz in London who then delivered it to Al
Quds al Arabia.896
In May 1998, Atef faxed Fawwaz another fatwa issued by a group of sheikhs in
Afghanistan. Fawwaz was instructed to send the fatwa, along with Bin Laden’s
comments, to al Quds, Al Sharq al Awsat, Al-Moharer, and Al Hayat.897 Atef told
Fawwaz that it would be best if Bin Laden’s comments on the fatwa were published
separately, probably to maximize exposure.898 Both the fatwa and Bin Laden’s
comments appeared a week later in Al Quds.899 Al Qaeda followed up the fatwa with a
press conference in Khost, Afghanistan.900 Al Qaeda foot soldiers transported foreign
journalists from Pakistan to the press conference and local guerrillas heralded al Qaeda’s
presence by firing their machine guns into the air.901
Later that month, Bin Laden gave a video interview to ABC News in Afghanistan.
In August 1998, at least a few days before the attacks on US Embassies in East Africa, al
Qaeda faxed a claim of responsibility for the attacks to a joint al Qaeda-Islamic Jihad
895 Bergen (2006), 202. 896 US v. UBL et al., Day 20. 897 Ibid. 898 Ibid, Day 20. 899 The 9/11 Commission Report, 69. 900 Burke, 158. 901 Ibid, 159.
236
office in Baku.902 The office was given orders to prepare to transmit the message to Al
Quds when they got the word from headquarters.903
Al Qaeda leaders also increased their personal contacts with journalists.
Sometime in early 1998, Bin Laden sent a letter to an associate in Pakistan asking him to
increase payments to selected journalists.904 Zawahiri conversed regularly with Pakistani
journalist Yusufzai via a satellite telephone, including immediately before and after the
1998 cruise missile strikes.905 Bin Laden called Al Quds editor Atwan after the missile
strikes to assure Atwan that he and his deputies survived the strikes.906
All the while, Bin Laden and his committee crafted his public image with
precision. For example, in one Al Quds interview, Bin Laden did not allow the
interviewer to record their conversation so that if he made a mistake the recording could
not be used to tarnish his image.907
Al Qaeda’s media committee played an important role in delivering the group’s
message. The media committee was responsible for issuing statements and reports in
support of the group’s operations.908 An internal al Qaeda document highlights the
902 The 9/11 Commission Report, 69. 903 Ibid, 70. 904 Burke, 158. 905 Yossef Bodansky, Bin Ladin: The Man Who Declared War on America, (Prima Publishing: Roseville,CA, 2001), 289. 906 Ibid, 293. 907 Bergen (2006), 170. 908 Blanchard, 1.
237
committee’s central role in providing information to Muslims about the plans of al
Qaeda’s adversaries.909
The media committee worked closely with the operational side of al Qaeda.
KSM, the chief operative and manager of the 9/11 attacks, occasionally worked with the
media committee during his career and was appointed by Bin Laden in October of 2000
to head the committee.910 Al Qaeda’s media representative in London, Fawwaz also
played an important role in the group’s publicity campaign. Fawwaz delivered Bin
Laden’s 1998 fatwa to media outlets in London, keeping in contact with top al Qaeda
leaders with a satellite phone.911 From 1998 to 2000, al Qaeda members made over 200
calls to Fawwaz, probably to discuss and calibrate al Qaeda’s media strategy and to
arrange for journalists to meet with Bin Laden in Afghanistan.912
It appears that al Qaeda’s media strategy paid off in some instances and attracted
Muslims as far afield as Europe and the United States. For example, al Qaeda member
Abdessater Dhamane came to Afghanistan in 2000 after being inspired by a news
program on Bin Laden in Denmark. Dhamane would assassinate Ahmed Shah Massoud
on 9 September 2001 for al Qaeda.913
While its statements and rhetoric were important for international support, al
Qaeda’s attacks also increased its popular appeal. Al Qaeda used the successful attack on
909 Combating Terrorism Center Department of Social Sciences United States Military Academy, Harmony and Disharmony Exploiting al-Qa’ida’s Organizational Vulnerabilities, Document: AFGP-2002-000078. 910 Interrogation of Khaled Sheikh Mohammed, US v. Mousaoui, Cr. No. 01-455-A, Defendant’s Exhibit 941, 2. / The 9/11 Commission Report, 150. 911 Corbin, 66. 912 Ibid, 66. 913 Bergen (2006), 258.
238
the USS Cole in 2000 to increase support and improve recruiting. Following the attack,
KSM produced a video that included a re-enactment of the attack mixed with images of
al Qaeda training camps and Muslims suffering in Chechnya and Palestine.914 The video
was widely disseminated and inspired many young men from Saudi Arabia and Yemen to
travel to Afghanistan for al Qaeda training, according to US officials.915 The US
Embassy in Nairobi was chosen as a target for the attack in 1998 because the
Ambassador was a woman, which al Qaeda reasoned would give the attack more media
coverage.916
US attacks against al Qaeda also proved to be a powerful driver of popular
support. US cruise missile attacks in Afghanistan in 1998 generated large demonstrations
in Pakistan and Egypt and led to a wave of pro-Bin Laden iconography across the
Muslim world.917 Pakistani journalist Rahmullah Yusufzai argued that the US cruise
missile strikes made Bin Laden a cult hero in Pakistan.918 Journalists Jason Burke argues
that donations to al Qaeda, which had been lagging, increased markedly after the
strikes.919
This method of attracting support would seem to be in conflict with al Qaeda’s
desire to maintain local popular support. While being attacked was good for international
support and sympathy, the local population might resent al Qaeda for attracting such
deadly attention of their region. There is a gap in our understanding of how strikes
914 The 9/11 Commission Report, 191. 915 Ibid, 191. 916 Corbin, 81. 917 Burke, 163. 918 Bodonsky, 295. 919 Burke, 163.
239
against al Qaeda affected the sentiment of the locals affected by the strikes. Given that al
Qaeda had privileged international popular support over local popular support, due in part
to the Taliban’s protection, it is not surprising that they made this tradeoff.
Al Qaeda had other means of attracting popular support. The group relied on
informal support networks in places like Saudi Arabia and Yemen to radicalize young
men and direct them towards al Qaeda. Some of the Saudi operatives involved in 9/11
were likely recruited through sympathetic contacts at universities and mosques in Saudi
Arabia.920 In 2000, Bin Laden married his fourth wife, who hailed from the northern
tribes of Yemen. Al Qaeda already had close relations with the Islamic Army of Aden,
an Islamic group from the south of the country, but his new marriage solidified his
contacts with the northern Yemeni Al Islah Party.921
Al Qaeda’s media strategy introduced several operational vulnerabilities in the
1996 to 2001 period. At the strategic level, al Qaeda’s inflammatory media statements
ultimately had to be backed with action against the group’s declared enemies. Al Qaeda
came under increase pressure to produce results that matched its rhetoric. In an interview
with Al Quds in Tora Bora in November 1996, Bin Laden defended the fact that al Qaeda
had not yet attacked despite its proclamation to do so in August 1996: “Preparations for
major operations take a certain amount of time, unlike minor operations. If we wanted
small actions, the matter would have been easily carried out immediately after the
[August 1996] statement.”922
920 The 9/11 Commission Report, 233. 921 Gunaratna, 48. 922 Burke, 150.
240
Al Qaeda also came under pressure from Taliban leader Mullah Omar to
discontinue its media campaign. The Taliban were coming under increased scrutiny by
the international community and Mullah Omar unsuccessfully relayed this concern to Bin
Laden when al Qaeda launched its media campaign in 1996. 923
Intelligence: Local and International. Al Qaeda’s intelligence capabilities were
more sophisticated in this period as the group conducted intelligence collection in support
of its terrorist operations.
Locally, al Qaeda’s intelligence efforts remained fairly basic and consisted mostly
of physical surveillance of its facilities and open source collection to support intelligence
analysis by al Qaeda’s leaders. One internal al Qaeda memo provided Atef’s assessment
of foreign reconnaissance aircraft activity near an al Qaeda compound.924 This memo
suggests that al Qaeda not only provided surveillance support for al Qaeda facilities but
also may have kept formal records of incidents and patterns.
Throughout this period, al Qaeda kept track of world events and provided leaders
with intelligence reports based on open sources. In the late 1990s, KSM was part of the
effort to collect news articles for al Qaeda leaders.925 Al Qaeda members sometimes
learned of operations after hearing about them from international news agencies, such as
Al Jazeera.926 Leaders would sometimes send operatives to Internet cafes to collect open
source information. For example, al Qaeda operative Iyman Faris searched for
923 Wright, 247. 924 Harmony and Disharmony Exploiting al-Qa’ida’s Organizational Vulnerabilities, Document: AFGP-2002-801138. 925 The 9/11 Commission Report, 149. 926 Harmony and Disharmony Exploiting al-Qa’ida’s Organizational Vulnerabilities, Document: AFGP-2002-003251.
241
information on ultralight aircraft at an Internet café in Karachi, Pakistan at the behest of a
top al Qaeda leader in 2001.927 Faris then provided a hard copy of the open source report
to the individual. In many cases, top leaders probably received clippings from Arab and
foreign press or breaking news from clippings of daily wire services.928 After visiting
Bin Laden in Afghanistan, Al Quds editor Atwan reported that Bin Laden had a huge
archive of data in hard copy and soft copy formats, including press clippings.929 Al
Qaeda’s Nairobi cell also followed local and international press reporting assiduously.930
Al Qaeda’s intelligence collection operations for its international operations
increased in sophistication in the 1996 to 2001 period. Al Qaeda probably developed an
intelligence collection protocol for its terrorist cells during this period. Al Qaeda
operative Owhali testified that the terrorist cell’s intelligence chief was the most
important member of the cell. The intelligence chief, according to Owhali, assessed the
operational environment and then assigned deputies and case agents to manage and
conduct the tasks needed to complete the mission.931
After the cell conducted surveillance of a series of targets, the intelligence was
then sent to Afghanistan, where al Qaeda leaders would study the information and decide
whether to move ahead with the operation, according to al Qaeda operative Kherchtou.932
927 US v Iyman Faris, Statement of Facts, United States District Court for the District of Eastern Virginia, Criminal Case. 928 Atwan, 34. 929 Ibid, 34. 930 Haroun Fazul Letter in Nairobi, acquired by PBS Frontline, available at: www.pbs.frontline.org. 931 Mohammad Rashed Daoud Al-Owhali Interrogation, U.S. v Moussaoui Cr. No 01-455-A, Defendant’s Exhibit 767, 5. 932 US v. UBL et al., Day 11.
242
Al Qaeda leaders seemed to have played a role in the analysis of intelligence for several
operations. The leaders played such a role in the US Embassy attacks. Al Qaeda cell
members in Nairobi would type up security and intelligence updates and then fax the
reports to Pakistan.933 From Pakistan they were delivered to al Qaeda leaders by
courier.934 Al Qaeda was probably using the Internet to transmit some of its collected
intelligence. In an internal al Qaeda memo from operative Abu Huthayfa to Bin Laden in
June 2000, Abu Huthayfa notes that websites such as www.driveway.com allowed users
to send up to 100MB of data to one another in one transmission.935
While cells probably had specific targets in mind when beginning intelligence
collection, there is evidence that al Qaeda cells used surveillance to search for targets of
opportunity. For example, the cell responsible for the attack on the USS Cole set up a
surveillance post in the hills overlooking the Aden harbor with the intention of finding a
vulnerable US vessel.936
Al Qaeda also collected intelligence by conducting “dry runs” of operations to
detect the security reaction to provocative or suspicious behaviors. Al Qaeda operative
Khallad tested security on an international flight from Malaysia to Hong Kong in 1999 by
bringing box cutters in his toiletries kit. During one of his flights he removed his
toiletries kit from his carry-on bags and noted the reaction of passengers and flight
933 Ibid, Day 12. 934 Ibid, Day 12. 935 Bergen (2006), 427. 936 United States of America v. Jamal Ahmed Mohammed Ali Al-Badawi, et al., S(12) 98 Cr. 1023 (KTD), Southern District Court of New York.
243
stewards.937 Bin Laden originally asked Khallad to conduct this intelligence collection
and it is likely that Khallad reported this information back to him.
Open sources remained a staple of al Qaeda intelligence collection. The al Qaeda
manual known as Military Studies in the Jihad Against the Tyrants argues that 80 percent
of intelligence relevant to the terrorist mission is available in open sources.938 The
manual notes that the percentage varies depending on the openness of the government but
that is it possible to get most information from newspapers, magazines, books,
periodicals and broadcasts.939 The 9/11 Commission report cites four instances where
KSM and his 9/11 operatives used the Internet to gather information or facilitate
communications.940
Additionally, operatives could reference the Encyclopedia of Jihad, the fifth
chapter of which is dedicated to lessons on spying, military intelligence, sabotage,
communication, security within jihad, and secret observation.941
Al Qaeda used local support networks to gather intelligence as well. The al
Qaeda cell in Nairobi used a local operative to learn about Nairobi and gather
937 The 9/11 Commission Report, 158-159. 938 Military Studies in the Jihad Against the Tyrants 939 Sharad S. Chauhan, The al Qaeda Threat, (APH Publishing House: New Delhi, 2003), 103. 940 Bruce Hoffman, The Use of the Internet by Islamic Extremists, Before the Permanent Select Committee on Intelligence United States House of Representatives, May 4, 2006, 11. 941 Chauhan, 14.
244
intelligence.942 Al Qaeda operative Odeh testified that locals relied on to gather
intelligence did not have to be full-fledged members of al Qaeda.943
There is limited evidence of al Qaeda espionage operations against key
adversaries during this period. In one instance, however, al Qaeda recruited a US Naval
enlistee to collect information on the movement of US battle groups. Al Qaeda operative
Babar Ahmed ran a jihadist website and received information from the enlistee about the
US destroyer on which he was stationed, the USS Benfold, via Ahmed’s website.944 The
enlistee was sympathetic to al Qaeda’s mission but had no prior connections to the group.
He provided Ahmed with information about his ship’s movements, its battle group
formation, and details about the best way to attack the ship with a small boat and
RPGs.945
Counterintelligence: Local. Al Qaeda increased the sophistication of its local
counterintelligence procedures in the 1996 to 2001 period.
Al Qaeda’s controlled territory offered key counterintelligence and security
advantages. While al Qaeda could move freely in and out of Taliban-controlled areas of
Afghanistan, most of its adversaries probably encountered some difficulty recruiting
sources and preparing operations in these areas. Journalist Steve Coll reported that al
942 Burke, 144. 943 US v. UBL et al., Day 12. 944 United States of America v. Babar Ahmed and Azzam Publications, District of Connecticut, 2004. 945 Ibid.
245
Qaeda’s adversaries had an easier time recruiting Afghan agents in the Jalalabad region,
where the Taliban’s control was weak.946
Though the Taliban’s agenda occasionally differed from al Qaeda’s, the Taliban
often helped the group improve its security. Following a series of security threats in
Jalalabad in 1996, Mullah Omar asked Bin Laden to move his organization to the
Taliban-controlled area of Kandahar.947 Omar almost certainly used this ‘invitation’ to
keep a better eye on the publicity-hungry Bin Laden, but al Qaeda would also benefit
from the closer ties to the ruling Taliban.
With the volume of recruits flowing into al Qaeda camps, the group developed
systematic camp security and counterintelligence procedures. Al Qaeda operative
Owhali testified that when he first arrived at the Khaldan training camp in Afghanistan he
immediately began to use an alias and was told by the camp supervisor that camp
members would never again use their real names.948 Shadi Abdalla, who served as Bin
Laden’s bodyguard in Afghanistan in 2000, reported that al Qaeda member Ramsi
Binalshibh wore a veil at training camps because he feared that there could be spies
among the recruits.949 Al Qaeda operative Iyman Faris told US authorities that some al
Qaeda members at the training camps wore black scarves, probably to mask their
946 Steve Coll, Ghost Wars: The Secret History of the CIA, Afghanistan and Bin Laden, from the Soviet Invasion to September 10, 2001, (The Penguin Press: New York, 2004), 471. 947 The 9/11 Commission Report, 65. 948 Mohammad Rashed Daoud Al-Owhali Interrogation, U.S. v Moussaoui Cr. No 01-455-A, Defendant’s Exhibit 767, 3. 949 Bergen (2006), 263.
246
identity.950 According to an internal al Qaeda document known as the “New Recruits
Form”, recruits must leave all forbidden items out of the camp, including tape recorders,
radios, cameras or video equipment.951 This indicates that al Qaeda believed that
photographs of its personnel and facilities could pose a threat to camp security.
Though al Qaeda vigorously cultivated its connections to select media
organizations and journalists, the group took great care to manage and monitor these
entities when they came into al Qaeda’s camps. After ABC News’ John Miller taped an
interview with Bin Laden, al Qaeda’s technical experts seized the tape, erased the faces
of several al Qaeda members caught on tape during the interview, and then returned the
tape to Miller.952 CNN journalist Peter Bergen and CNN correspondent Peter Arnett had
to pass a number of security checks before interviewing Bin Laden in 1997. The
journalists first had to travel to London to be vetted by al Qaeda representative Fawwaz,
who asked them if they worked for the US government. When they were approved to
meet with Bin Laden a month later, the two men were greeted in Afghanistan by a coterie
of al Qaeda security guards, who told them they couldn’t bring their own camera for
security reasons.953 To prevent the journalists from retracing their steps to al Qaeda’s
facilities, the men were blindfolded and driven to the camp, switching vehicles several
times.954 Just before entering the camp, the journalists were told that if they had tracking
950 US v Iyman Faris, Statement of Facts, United States District Court for the District of Eastern Virginia, Criminal Case. 951 Bergen (2006), 406. 952 Wright, 264. 953 Bergen (2006), 180. 954 Bergen (2004).
247
devices they would be killed, unless they declared them to al Qaeda security
immediately.955 Bergen alleges that they were also swept for electronic devices.956
Other journalists’ accounts of meeting with Bin Ladin corroborate this data. Al
Quds editor Atwan was instructed to fly to Peshawar, Pakistan and was then contacted
secretly by an intermediary before he met with Bin Laden.957 Atwan was moved from
Peshawar to a safehouse in Jalalabad and finally taken to an al Qaeda camp. Atwan
recalls that the camp was well-protected, with anti-aircraft guns, armoured vehicles and a
heavily controlled approach road.958
The group took extraordinary precautions to protect Bin Laden, in particular. Bin
Laden sometimes had fourteen bodyguards at a time armed with automatic weapons.959
When Saudi Arabia sent an assassin to kill Bin Laden in 1998, Bin Laden’s armed
entourage easily captured the man.960 Al Qaeda selected only trusted Arabs to serve as
bodyguards for Bin Laden to eliminate the chances of a ‘turned’ Afghan or Taliban
bodyguard trying to kill or spy on the leader.961 Former Bin Laden bodyguard Abdalla
reported that bodyguards were only trusted after they had served for an extended time in
Bin Laden’s entourage.962 Before Abdalla was fully trusted, he was only allowed near
955 Bergen (2006), 181. 956 Bergen (2004). 957 Atwan, 23. 958 Ibid, 33. 959 Bergen (2006), 241. 960 Ibid, 241. 961 Daniel Byman, “Strategic Surpirse and the September 11 Attacks,” Annual Review of Political Science 2005, 165. / Gunaratna, 42. 962 Bergen (2006), 263.
248
Bin Laden when the leader was on the move.963 Bin Laden also had special protection
from new al Qaeda recruits. Any recruit that wanted to meet with Bin Laden had to go
through additional vetting.964
Bin Laden rarely spent two nights in the same place and would move around
Afghanistan in a convoy of up to twenty vehicles, armed with rocket launchers, surface to
air missiles, and automatic weapons.965 Bin Laden would travel very secretly, often
showing up by surprise after his security detail cleared and guarded the route he was
planning to take.966 For the most part, Bin Laden’s arrival was not heralded by fanfare
and rocket-fire, unless al Qaeda was making a propaganda film or trying to impress
journalists.967 On the other hand, Steve Coll reported that Bin Laden’s journey’s within
Afghanistan sometimes followed a predictable path: he would move from Kandahar to
Ghowr province, where there was a valley he enjoyed visiting, and then to Jalalabad and
back to Kandahar.968
Bin Laden’s living quarters were relatively easy to secure given the remoteness of
the al Qaeda camps. He lived in a concrete compound surrounded by a ten-foot wall in
the middle of an isolated desert on the outskirts of Kandahar.969 An attempt to breech
this fortress would probably have been easy for Bin Laden’s security detail to detect.
963 Ibid, 263. 964 Ibid, 261. 965 Simon Reeve, The New Jackals: Ramzi Yousef, Osama bin Laden and the Future of Terrorism, (Northeastern University Press: Boston, 1999), 193. 966 Bergen (2006), 265. 967 Ibid, 265. 968 Coll, 500. 969 The 9/11 Commission Report, 112.
249
Al Qaeda had effective local security procedures for its members as well.
Following their terrorist operations, members anticipated US retaliation strikes at the
camps and would flee the camps. Al Qaeda leaders fled Kandahar for the countryside
after the US Embassy bombings in 1998.970 General camp warnings were issued two
weeks before the USS Cole attack and ten days before the 9/11 attacks.971 During such
an alert, al Qaeda members would leave the camps with their families and Bin Laden
would remain sequestered until the alert was cancelled.972 For the USS Cole attack, Bin
Laden split up his top leaders, sending Atef to a location in Kandahar and Zawahiri to
Kabul, thereby reducing the odds that the group’s top leaders would be killed in a single
strike.973 Before the 9/11 attacks, Bin Laden and Zawahiri fled to the mountains of
Khost.974
To protect the group against espionage and information leakage, al Qaeda
expected high security awareness among its recruits and mid-level managers. An internal
al Qaeda memo lists the qualities of potential leaders of the group’s information
committee. Every leader is required to have five years of work experience and be able to
keep a secret.975 Another al Qaeda memo provides details of a computer system used to
track al Qaeda personnel matters.976 The memo states that each recruit should have
970 Ibid, 69. 971 Huge CI vulnerability for the attack cell, but tradeoff with local security. 972 The 9/11 Commission Report, 250. 973 Wright, 331. 974 Ibid 356. 975 Harmony and Disharmony Exploiting al-Qa’ida’s Organizational Vulnerabilities, Document: AFGP-2002-000078. 976 Harmony and Disharmony Exploiting al-Qa’ida’s Organizational Vulnerabilities, Document: AFGP-2002-000112.
250
“continuous personnel follow-up which accompanies him to any place he is
transferred.”977 According to the same memo, recruits are encouraged to take courses in
member security, group security, and communications security.978 Al Qaeda established
special training course at some of its camps to improve recruits’ security practices and
their ability to set up and run a clandestine cell.979 New arrivals in al Qaeda camps were
given extra scrutiny. Before these new comers were granted access to the camp they had
to surrender their personal belongings.980 In some cases, camp supervisors would
personally assess a new comer to determine if the recruit was sincere in his commitment
to al Qaeda’s goals.981
Al Qaeda practiced good communications security in this period as well. Internal
al Qaeda communications recommended that members not use email or the telephone but
faxes and couriers instead.982 It is unclear why al Qaeda believed that fax machines were
more secure than telephones. Before 9/11, Bin Laden used Inmarsat satellite telephones
and possibly two electronic scramblers to encrypt his conversations.983
The group also adapted its communication security procedures to changes in their
adversaries’ methods. When several individuals connected to al Qaeda abroad were
compromised in 1998, al Qaeda members in Afghanistan began to rely more heavily on a
977 Ibid. 978 Ibid. 979 Mohammad Rashed Daoud Al-Owhali Interrogation, U.S. v Moussaoui Cr. No 01-455-A, Defendant’s Exhibit 767, 4. 980 Bergen (2006), 264. 981 Ibid, 264. 982 Cullison. 983 Reeve, 206.
251
communication coding system called the one-time-pad system.984 The group also
changed code names for personnel and facilities.985 The 9/11 Commission determined
that al Qaeda’s senior leadership stopped using a particular means of communication
almost immediately after a leak to the Washington Times, which made it more difficult
for US authorities to eavesdrop on their conversations.986
Al Qaeda developed more systematic methods for securing its documents and
files. An internal al Qaeda memo recommends keeping personnel files in a safe place in
the main office of headquarters.987 The same memo is itself classified as “Very Secret”,
suggesting that the group altered the way it protected a document based on its
sensitivity.988 An al Qaeda computer recovered after the fall of the Taliban in 2001
provided even more detail of the group’s document security practices. The computer,
probably belonging to Zawahiri, contained approximately a thousand text documents,
encrypted and protected with passwords, written in what one journalist assessed as “an
elliptical and evolving system of code words.”989
Al Qaeda’s most dangerous local counterintelligence threats resulted directly
from its campaign to garner international popular support—specifically, its contact with
international media and its methods for claiming credit for attacks.
984 The one-time pad system is a simple cryptographic mechanism, used by the Allied and Axis powers in World War II, that pairs individual letters with randomly assigned numbers and letters that made messages readable only to those who know the pairing key. 985 Cullison. 986 The 9/11 Commission Report, 127. 987 Harmony and Disharmony Exploiting al-Qa’ida’s Organizational Vulnerabilities, Document: AFGP-2002-000112. 988 Ibid. 989 Cullison.
252
Al Qaeda’s contact with the media introduced numerous counterintelligence
vulnerabilities. First, group members had to interact with the media over the telephone,
Internet, or in person to convey their message or threat. Atef called Al Quds editor
Atwan on 21 August 1998, after US cruise missiles hit Afghanistan, to tell Atwan that
Bin Laden and key group leaders were still alive.990 Al Qaeda needed to make this call to
reassure its base of international supporters that they were still in business, but the phone
call itself could have provided valuable targeting information to its adversaries. Bin
Laden and Zawahiri also used their phones to contact the media following the 1998 cruise
missiles strikes.991
Second, al Qaeda allowed certain interviews to be video-taped, which
occasionally offered valuable information about the group’s location, faces of unknown
al Qaeda operatives, and the health of key individuals. During the ABC News interview
in 1998, al Qaeda technical experts had to black out the faces of two of its operatives who
accidentally got in the picture with Bin Laden. The two Saudis were Mohammed Owhali
and Jihad al Azzam, who would fly to Kenya to join the al Qaeda cell responsible for the
US Embassy bombing in Nairobi.992 Had the technical experts not caught the mistake,
the identity of these two men could have been used to apprehend them before the attack.
Moreover, the fact that al Qaeda needs to employ technical experts introduces a
counterintelligence vulnerability. These individuals could be targeted and recruited by
intelligence services at universities before or after they have joined al Qaeda.
990 Atwan, 55. 991 Wright, 283. 992 Ibid 264.
253
Al Qaeda’s need to claim responsibility for its attacks also introduced
vulnerabilities. Before the 9/11 attacks, Bin Laden insinuated to some trainees and high-
level visitors that al Qaeda was planning a large attack against the US. KSM and Atef
urged Bin Laden to exercise greater discretion and refrain from bragging about the
upcoming mission.993 In some cases, al Qaeda transmitted their claim of credit before the
attack occurred, possibly to ensure that another group would not make the first claim of
credit. Perhaps if law enforcement had closely monitored these transmissions they would
have raised security alert levels at probably targets prior the attack.
Al Qaeda’s campaign to reach out to the international media imperiled its
relationship with the Taliban at times. When Mullah Omar asked al Qaeda to move from
Jalalabad to Kandahar in 1996 he was probably motivated by a desire to keep a better eye
on Bin Laden in light of his developing inflammatory media campaign.994 Elements of
the Taliban were set against Bin Laden as his inflammatory statements brought negative
international attention to the Taliban regime. Taliban Foreign Minister Muttawakil
ordered that Bin Laden be placed under surveillance and asked Mullah Omar to reign in
the terrorist leader.995 Allegedly, Bin Laden used to say of Muttawakil: “Two entities are
against our jihad…one is the US, and the other is the Taliban’s own foreign ministry.”996
The group’s record keeping also brought some counterintelligence setbacks. For
example, al Qaeda recruiter Abu Zubaydah kept files on al Qaeda recruits, which he used
993 Interrogation of Khaled Sheikh Mohammed, US v. Mousaoui, Cr. No. 01-455-A, Defendant’s Exhibit 941, 31. 994 Wright, 247. 995 Bergen (2006), 250. 996 Ibid, 250.
254
to match individuals with required tasks.997 It is probably necessary for a group to keep
records of its personnel, and perhaps can even improve the group’s counterespionage
capabilities by keeping track of security violators. However, improper storage and
destruction of such files backfired for al Qaeda when they evacuated Kabul on 12
November 2001. In 2001, journalist Alan Cullison purchased two al Qaeda computers
containing sensitive organizational and operational information that had been looted from
al Qaeda’s central office.998
Al Qaeda also suffered from espionage in its camps and recruitment of its lower
level members. Bin Laden’s chief bodyguard in 2001, Abu Jandal, told reporters that an
Afghan cook working for a foreign intelligence service provided information about Bin
Laden’s movements in August 1998.999
The nature of al Qaeda’s controlled territory in Afghanistan also brought security
vulnerabilities. Al Qaeda lived and trained in camps far removed from urban centers and,
as a result, it was easier for the US to justify large-scale strikes against the group.1000
Had al Qaeda been based in an urban center, the US may have hesitated to strike the
group to avoid generating unacceptable collateral damage.
Counterintelligence: International. Al Qaeda international counterintelligence
capabilities in the 1996 to 2001 period were increasingly sophisticated and systematic.
The group established a formal system for evaluating individuals coming to train
at al Qaeda camps in Afghanistan. Before candidates received training from al Qaeda
997 Corbin, 79. 998 Cullison. 999 Atwan, 62. 1000 Benjamin and Simon, 153.
255
they were screened and vetted at guesthouses and camps.1001 Recruits would transit
through Peshawar or Karachi, where they wait for up to two weeks while their papers
were verified and their backgrounds scrutinized.1002
Al Qaeda had new comers fill out a “New Recruits Form” where an individual
would indicate his security status in his country of origin, whether he could return to his
country, how he arrived in Afghanistan, and the problems he encountered while traveling
to Afghanistan.1003 Recruits were asked to write an account of their trip to Afghanistan,
presumably to assess other counterintelligence concerns associated with the new comer
and to catalogue the counterintelligence vulnerabilities likely to encumber future
travelers.
Once at the camps, recruits were kept away from sensitive facilities and
individuals. Islamic conferences or summits were held in isolated buildings or tents in the
camp so that trainees and other bystanders could not see who was attending.1004 One al
Qaeda training manual reminds recruits that keeping secrets and concealing information
from even the closest of friends and relatives is a necessary qualification for
membership.1005 Recruits were also given advice on how to blend in and avoid
surveillance once they were operating overseas. US authorities captured al Qaeda
operative Ahmed Omar Abu Ali with a six-page document on how to avoid various forms
1001 The 9/11 Commission Report, 67. 1002 John Miller and Michael Stone, with Chris Mitchell, The Cell: Inside the 9/11 Plot, and Why the FBI and CIA Failed to Stop It, (Hyperion: New York, 2003), 260. 1003 Bergen (2006), 403. 1004 Bodonsky, 289. 1005 Chauhan, 46.
256
of surveillance by government and private entities.1006 Operatives sometimes received
further counterintelligence instruction from al Qaeda members familiar with the country
to which they would be deployed. Operatives Binalsheibh and Mohammed Atta received
training in security precautions specific the United States from KSM in 2000 in
Karachi.1007
The al Qaeda manual also provides members with counter interrogation tips. The
manual instructs members to have prepared answers to questions about the purpose and
length of their trips when traveling through airports.1008 The manual tells members about
what a common interrogation looks like and what techniques an interrogator will use to
elicit information, including blindfolding and torture.1009 Members are told that they
should not speak to anyone in their prison cell because some prisoners could be enemy
agents.1010 Finally, the manual suggests that members memorize the procedures and
content of the interrogation so that other members can learn from the experience.1011
Al Qaeda practiced good operational security in the 1996 to 2001 period. First,
the group compartmented its operational cells. The 9/11 attacks offer an example of the
degree to which al Qaeda restricted information about the operation among its cells.
Only Bin Laden, KSM, Atef and a few senior hijackers knew about the specific timing,
1006 United States v. Ahmed Omar Abu Ali, Criminal No. 1:05CR53, Feb 2005.. 1007 The 9/11 Commission Report, 167. 1008 Chauhan, 83. 1009 Ibid, 163. 1010 Ibid, 164. 1011 Ibid, 168.
257
targets, operatives, and method of attack.1012 According to KSM, the thirty-four
individuals involved in the 9/11 attacks were divided into five groups with varying access
to operational details. The first group, the principal decision makers, consisted of Bin
Laden, KSM, and Atef, Binalsheibh (the communications link between KSM and Atta),
and Abu Turub al-Urduni (the trainer of the ‘muscle’ hijackers).1013 These individuals
would have known almost all the sensitive details of the operation.
The second group, the principal hijackers, consisted of Atta, Al Shehhi, Hani
Hanjour, Ziad Jarrah, Nawaf al-Hamzi, and Khalid Mihdhar. These individuals were
privy only to operational details that concerned their respective missions. The third
group consisted of the other thirteen hijackers, all of whom were ‘muscle’ hijackers.
These individuals did not learn much about the operation, including that they would
flying hijacked airplanes into buildings, until Atta briefed them on the operation in
August of 2001.1014
The fourth group consisted of four individuals who handled logistical, financial
and training aspects of the operation and these individuals only knew that they were
involved in an al Qaeda operation against the US. The fifth group consisted of the seven
‘muscle’ hijackers that were unable to get into the US and these men only knew that they
were to be involved in a suicide operation inside the US.1015
1012 Interrogation of Khaled Sheikh Mohammed, US v. Mousaoui, Cr. No. 01-455-A, Defendant’s Exhibit 941, 21. 1013 Ibid, 24. 1014 Interrogation of Khaled Sheikh Mohammed, US v. Mousaoui, Cr. No. 01-455-A, Defendant’s Exhibit 941, 25. 1015 Ibid, 26.
258
The US Embassy operation followed a similar protocol. For example, al Qaeda
technical advisor to the Nairobi attack Mohamed Odeh never met al Qaeda cell member
Owhali, who constructed the bomb and participated in the attack.1016 All the while, the
cell would report back to al Qaeda headquarters with security updates and requests for
logistical support. One report back to headquarters, captured off of Fawwaz’s computer,
provided a security assessment and reported the cell’s desire to secure cell
communications with a satellite telephone.1017
It is possible that many other operations were compartmented in this manner.
When camp graduates made their requests for operational and logistical support from al
Qaeda, they did so separately and directly to Bin Laden and Atef. Thus, very few
individuals were in a position to see al Qaeda’s full operational picture.1018
Al Qaeda cells also enhanced operational security by blending into their local
environments. Operation planners tried to select environments where blending in would
be easy. While casing flights in 1999, al Qaeda operative Khallad traveled to Malaysia
because Malaysians did not heavily scrutinize Saudi Arabians or suspected Islamist
jihadists.1019 Saudis were also used for the 9/11 attacks because the US did not scrutinize
them as heavily as others coming from the Middle East.1020 The Hamburg cell distanced
themselves from Islamist extremists, wore Western clothing and shaved their beards.1021
1016 Phil Hirschkorn, “Trial Spotlights America’s Top Terrorist Threat,” The Journal of Counterterrorism & Security International, 2001 Summer, Vol. 7, No. 4. 1017 US v. UBL et al., Day 20. 1018 Burke, 188. 1019 The 9/11 Commission Report, 158. 1020 Burke, 222. 1021 The 9/11 Commission Report, 167.
259
Al Qaeda operatives used code names and ‘Abu’ names to further increase security.
Operative Owhali could not provide the FBI with the true names of his colleagues when
he became a US informant because he only knew their code names.1022
Al Qaeda’s operational security protocol included moving non-attack personnel
out of the area of operations prior to the attack. For example, before the USS Cole
operation, the senior commander of the attack left Yemen.1023 Said Bahaji, the logistical
support element for the Hamburg cell, fled to Pakistan several days before the 9/11
attacks.1024 1025 Several days before the US Embassy bombings, cell members not
involved in the attack had mostly left East Africa.1026
Elements of al Qaeda enhanced operational security by securing internal
documents that could give away sensitive details about the group. One al Qaeda cell
member reported that he had collected the cell’s sensitive files and moved them to a
secure location when he though law enforcement personnel were watching the group.1027
The group also practiced good communications security. Operational planners
consistently demonstrated good communications security awareness. Fawwaz demanded
that Nairobi cell members not to call him on his telephone as he was certain that it was
‘tapped.’1028 Only select members of the Nairobi cell were allowed to make international
1022 Mohammad Rashed Daoud Al-Owhali Interrogation, U.S. v Moussaoui Cr. No 01-455-A, Defendant’s Exhibit 767, 2. 1023 Burke, 193. 1024 Vidino, 34. 1025 This also introduces some CI vulnerabilities in that he knew the dates of the attack. 1026 The 9/11 Commission Report, 69. 1027 Haroun Fazul Letter in Nairobi, acquired by PBS Frontline, available at: www.pbs.frontline.org. 1028 Reeve, 192.
260
telephone calls, according to al Qaeda member Odeh.1029 Atta reported to KSM that he
had forbidden his 9/11 hijackers from calling their families to say goodbye to them before
the attack.1030 Very sensitive communications were conducted via couriers when
possible. KSM was informed of the date of the 9/11 attacks by al Qaeda courier Zakariya
Essabar, who hand-carried the letter from Germany to Afghanistan.1031 The 9/11
hijackers used anonymous mail and Internet centers, such as Kinkos and Mail Boxes Etc,
to send electronic and paper messages.1032
Al Qaeda couriers were typically recruited from among al Qaeda members who
could maintain a low profile. Couriers would probably not know the purpose or end user
of their ‘package’ and in some cases would hand off the ‘package’ to another courier.1033
Al Qaeda used couriers to transfer funds as well as messages. Al Qaeda reportedly used a
Pakistani-based hawaladar to move $1 million from UAE to Pakistan, at which point
another hawaladar passed the money to a courier who smuggled the funds into
Afghanistan.1034
Al Qaeda also used encryption and coded messages to enhance communications
security. Messages found on an al Qaeda computer recovered from Afghanistan were
encrypted, sometimes with the one-time pad system or coded in the language of the
1029 US v. UBL et al., Day 12. 1030 The 9/11 Commission Report, 245. 1031 Interrogation of Khaled Sheikh Mohammed, US v. Mousaoui, Cr. No. 01-455-A, Defendant’s Exhibit 941, 30. 1032 Corbin, 217. 1033 Staff Report of the National Commission on Terrorist Attacks Upon the United States, “Monograph on Terrorist Financing,” 26. 1034 Ibid.
261
multi-national firm.1035 Odeh reported to US authorities that members in Kenya referred
to jihad as work, weapons as tools, hand grenades as potatoes, and bad documents as
papers.1036 Bin Laden was referred to as the contractor and US and UK intelligence
services were referred to as foreign competitors. The al Qaeda cell leader for the USS
Cole attack sent a coded pager message to the operative in charge of filming the attack to
indicate that the attack was imminent.1037
Owhali made a telephone call to his logistical contact in Nairobi following the
attack and could not use coded language, so instead spoke cryptically to request a
passport and money to get out of Kenya.1038
KSM actually advised his cells to use code words sparingly, as he believed
overuse would attract the attention of hostile intelligence services. He asked his
operatives to keep their messages as normal and as short as possible.1039 KSM also
delegated operational authority to his subordinates in order to keep his communication
with his cells to a minimum.1040
Al Qaeda helped its operatives stay clandestine by providing them with forged
documents. The al Qaeda manual recommends that every member have forged identity
cards and passports.1041 The group tried to forge or steal high-quality papers, particularly
1035 Cullison. 1036 US v. UBL et al., Day 12. 1037 43, 15. 1038 Mohammad Rashed Daoud Al-Owhali Interrogation, U.S. v Moussaoui Cr. No 01-455-A, Defendant’s Exhibit 767, 14. 1039 Interrogation of Khaled Sheikh Mohammed, US v. Mousaoui, Cr. No. 01-455-A, Defendant’s Exhibit 941, 10. 1040 Ibid, 10. 1041 Chauhan, 51.
262
from Western countries.1042 The al Qaeda office of passports and host country issues,
based at the Kandahar airport and managed by Atef, altered passports, visas, and
identification cards.1043 Operatives probably received some training to alter documents
on their own. Al Qaeda operative Ahmed Omar Abu Ali received training in document
forgery in Saudi Arabia.1044 As a testament to their training and preparation, al Qaeda
operatives involved in the 9/11 operations carried a cache of alias documentation and
pocket litter that supported their false identity, including ID cards and medical, banking
and educational records.1045
Al Qaeda probably enjoyed enhanced operational security as a result of the close
ties between individuals in its cells. Nairobi cell member Kherchtou testified that he
joined al Qaeda with four of his friends.1046 Training camps in Afghanistan also helped to
bring members together with a shared experience, building confidence and creating an
espirit de corps.1047 Though there is no direct evidence that this closeness resulted in
counterintelligence benefits, it is probable that members were less likely to betray their
cell and their friends once these relationships were formed. On the other hand, it is
possible that closeness would lead to informality and more non-essential communication,
which could produce counterintelligence vulnerabilities. Hamburg cell members, for
example, frequently emailed one another to share experiences and jokes, which helped
1042 Vidino, 81. 1043 The 9/11 Commission Report, 169. 1044 United States v. Ahmed Omar Abu Ali, Criminal No. 1:05CR53, Feb 2005. 1045 Staff Report of the National Commission on Terrorist Attacks Upon the United States, “9/11 and Terrorist Travel,” 56. 1046 Sageman, 111. 1047 Ibid, 121.
263
them foster and maintain an emotional closeness.1048 Thus, the closeness of individuals
may have made them less susceptible to espionage but more susceptible to
eavesdropping.
Al Qaeda may have engaged in more sophisticated counterintelligence practices,
such as deception and rapid adaptation to security procedures. The al Qaeda manual
counsels its members to mislead the adversary with fake telephone conversations if the
adversary is monitoring calls.1049 However, though the Nairobi cell believed its phones
were tapped there was no evidence they engaged in deceptive communications. The
manual also recommends that operatives agree on a purposefully misleading cover story
in the event they are captured and interrogated.1050 Deception operations require lots of
coordination and pre-planning, and therefore are less likely to have been used by al
Qaeda, particularly in any systematic manner.
On occasion, al Qaeda rapidly adapted its security procedures to prevent the
leakage of sensitive information or to stay one step ahead of its adversaries’
counterterrorism efforts. When al Qaeda member Khallad was captured in Yemen before
the USS Cole operation, Bin Laden contacted a Yemeni officials and successfully
negotiated Khallad’s release. Bin Laden was worried that Khallad would break under
interrogation and reveal Nashiri’s plans to hit a US naval vessel in Yemen.1051 KSM
1048 Ibid, 159. 1049 Chauhan, 60. 1050 Ibid, 92. 1051 The 9/11 Commission Report, 156.
264
anticipated the US security response to the 9/11 attacks and planned a second wave of
attacks that relied on non-Arab country passport holders to conduct the mission.1052
Al Qaeda faced its share of counterintelligence setbacks in the 1996 to 2001
period. First, as al Qaeda spread itself out across the world, and remained centrally
controlled, the need to keep in touch with its operatives via telephone and the Internet
increased.1053 Connections between the individuals made them vulnerable to monitoring
and targeting by savvy intelligence services. For the US Embassy bombing operations al
Qaeda operative Ahmed Abdallah in Tanzania used a cellular telephone to keep in touch
with overall operational commander Saleh in Nairobi.1054 Al Qaeda member Fawwaz
calls the London-based media outlet Al Quds Al Arabia for over thirty minutes in
February 1998 to dictate Bin Laden’s fatwa to the newspaper.1055 Yemeni telephone
records from 1998 to 2000 show that the operatives involved in the USS Cole attack were
talking to operatives involved in the US Embassy bombings.1056
Al Qaeda experienced a similar vulnerability as a result of its need to claim credit
for its attacks. In many cases, al Qaeda relayed its claim of credit for an attack before the
operation took place. For the US Embassy bombings, al Qaeda videotaped their would-
be suicide bomber, Owhali, in Pakistan before he made the final trip to Kenya to prepare
1052 Interrogation of Khaled Sheikh Mohammed, US v. Mousaoui, Cr. No. 01-455-A, Defendant’s Exhibit 941, 41. 1053 Encouraging vulnerabilities: tight command and control has its disadvantages for a global group…global groups may need to be loose for communications security purposes. 1054 Stephen Ulph, “Intelligence War Breaks out on the Jihadi Forums,” Terrorism Monitor, Volume 3, Issue 14, April 11, 2006, 9. 1055 US v. UBL et al., Day 20. 1056 Burke, 193.
265
for the operation.1057 Al Qaeda headquarters then sent its media contact in London a
letter claiming responsibility for the upcoming attack. They assumed Owhali would
complete his suicide mission and so claimed in their letter that two Saudis in Nairobi and
one Egyptian in Dar Es Salam had perished in the attacks.1058 Before the operation, the
Nairobi cell also sent a fax to the Cairo office of Al-Hayat newspaper from Egyptian
Islamic Jihad threatening an imminent attack against US interests.1059
For this operation in particular, the adversary’s intelligence service would have
had the opportunity to intercept communications regarding an attack involving two
Saudis and an Egyptian in specific locations, and perhaps could have obtained the video
bearing Owhali’s image. These communications also created counterintelligence
problems in the post-attack environment. UK’s security service tracked the claim of
credit to Fawwaz in the wake of the US Embassy bombings and sent him to a maximum-
security prison for his aid to al Qaeda.1060
Before the US Embassy and USS Cole attacks Bin Laden issued an interview and
a video, respectively, threatening an attack on US interests. In both media events, Bin
Laden put a ‘teasing’ clue about the upcoming attacks—for the USS Cole attack video he
wore a distinctive, curved Yemeni dagger in his belt.1061 This may have been subtle
1057 Mohammad Rashed Daoud Al-Owhali Interrogation, U.S. v Moussaoui Cr. No 01-455-A, Defendant’s Exhibit 767, 6. 1058 Gunaratna, 161. 1059 Burke, 160. 1060 Corbin, 89. 1061 Wright, 331. ; Bin Laden’s ‘teasing clue’ in his June 1998 interview with ABC news was his statement that he predicted a black day for Americans when they would bring their civilians and soldiers home in coffins—two months later al Qaeda attacked the US Embassies in Kenya and Tanzania.
266
manner of making sure credit was given to al Qaeda in the aftermath, but it also
introduced some chance that the clue would be useful to those trying to prevent the
attacks.
Al Qaeda’s publicity campaign videos occasionally gave away sensitive
information about the group. As Bin Laden became more popular in the Muslim world in
the late 1990s, his ‘public’ demanded more information about him. Bin Laden obliged,
and video interviews he granted to CNN, ABC News, and Al Jazeera gave away valuable
information about his health and location.1062 For example, Bin Laden claimed that he
would regularly ride horseback for more than 70 kilometers—information that would be
valuable for those assessing his health or those studying Bin Laden’s modes of travel.
Al Qaeda also subjected itself to potentially crippling counterintelligence
weakness in its extensive travel. The four pilots for the 9/11 operation passed through
US immigration and customs inspections 17 times between 2000 and 2001. Ziad Jarrah
alone entered the United States seven times.1063
Al Qaeda’s reliance on personal connections for recruiting and advancement
provided the group with counterintelligence advantages and disadvantages. On the one
hand, personal connections provided al Qaeda with a quick and low-cost vetting process.
However, personal connections also muddied their decision-making about how to punish
security violations. Bin Laden had a personal affiliation for 9/11 operative al-Midhar,
and prevented KSM from excluding him from the 9/11 attacks after al-Midhar made an
1062 Corbin, 91. 1063 Staff Report of the National Commission on Terrorist Attacks Upon the United States, “9/11 and Terrorist Travel,” 7.
267
unauthorized departure from San Diego in 2000.1064 Shadi Abdalla, one of Bin Laden’s
bodyguards in Afghanistan, enjoyed a special position of trust in al Qaeda simply because
Bin Laden’s brother-in-law recruited him in Mecca and Binalsheibh had good person
rapport with him.1065
Personal connections could also create vulnerabilities if an intelligence service
can link individuals through kinship ties. Nearly every ‘muscle’ hijacker for the 9/11
operation could be linked to each other and other al Qaeda members through kinship and
friendship.1066
Al Qaeda’s use of face-to-face communications also had its counterintelligence
advantages and disadvantages. On the one hand, face-to-face meetings reduced al
Qaeda’s communications profile, making the interception of those conversations nearly
impossible. On the other hand, face-to-face communications takes longer and requires
traveling, which allows intelligence services to monitor an operative’s physical
movements more easily. For example, KSM reported that he would deliver oral updates
to Bin Laden, which required him to travel for a day and a half in some instances.1067
This slowed the organization’s response, in theory, to information that KSM was
collecting in the field—information that could have related to counterintelligence
problems that needed immediate fixing. Al Qaeda’s limited supply of trusted couriers
1064 Interrogation of Khaled Sheikh Mohammed, US v. Mousaoui, Cr. No. 01-455-A, Defendant’s Exhibit 941, 21. 1065 Bergen (2006), 262. 1066 Sageman, 50. 1067 Interrogation of Khaled Sheikh Mohammed, US v. Mousaoui, Cr. No. 01-455-A, Defendant’s Exhibit 941, 55.
268
probably also restricted its ability to move messages and funds quickly.1068 All of the
9/11 hijackers met occasionally in Las Vegas and Florida, traveling together to and from
these locations.1069 This provided them with valuable face-to-face planning time but also
could have implicated all of the hijackers if one of them had come under the scrutiny of
the FBI.
Al Qaeda’s strategy to provide its operational cells with a degree of autonomy
generated several counterintelligence problems. First, operational planners did not
always know whether their operatives were following security protocols. KSM reported
that he instructed his hijackers not to talk to one another in the US, but he had no way of
checking up on them to make sure.1070 Second, planners could not easily discipline
operatives when they violated protocol. KSM instructed al Qaeda operative Moussaoui
not to mention airplanes in his communications with him or Binalsheibh but Moussaoui
nevertheless mentioned flight training in an email. The greatest discipline KSM could
exact on Moussaoui was to cut him out of the operation and require other operatives to
cut off communication with him.1071
Operations that were even more autonomously designed had additional
counterintelligence problems. Many al Qaeda operations were partially or completely
self-financed. Some of the self-financed operations relied on criminal activities to raise
funds. Conducting criminal activities in some cases raised the operatives’ profiles and
1068 Staff Report of the National Commission on Terrorist Attacks Upon the United States, “Monograph on Terrorist Financing,” 26. 1069 Sageman, 167. 1070 Interrogation of Khaled Sheikh Mohammed, US v. Mousaoui, Cr. No. 01-455-A, Defendant’s Exhibit 941, 36. 1071 Ibid, 49.
269
exposed them to law enforcement.1072 Al Qaeda operatives arrested while preparing for
the Millennium attack in Jordan had financed their operation with bank-robberies,
burglary and forged checks.1073 Even the 9/11 operation, which was fully funded,
exposed itself to scrutiny when operative remitted their unspent funds back to al Qaeda
before the attacks.1074
Al Qaeda also suffered from information stolen by spies in this period. Following
al Qaeda’s move to Afghanistan in 1996, the husband of one of the Bin Laden’s nieces
surrendered himself to Saudi Arabian intelligence and divulged details of Bin Laden’s
funding network.1075 Al Qaeda member Al-Fadl also gave himself to US authorities in
1996, providing the US with a rare look at al Qaeda’s inner workings.1076
Summary. Al Qaeda developed powerful adversaries in the Middle East and the
West. Al Qaeda’s structure in the 1996 to 2001 period remained relatively hierarchical,
though the operatives deployed outside of Afghanistan retained some operational
autonomy. Al Qaeda’s access to financial resources, high quality personnel and
controlled territories continued in the 1996 to 2001 period. Al Qaeda’s local popular
support remained relatively low, but the group’s international increased substantially
between 1996 and 2001. The increase is the result of a series of successful al Qaeda
attacks and an increase in inflammatory public statements. Al Qaeda’s intelligence and
counterintelligence capabilities were more sophisticated in this period.
1072 Javier Jordan and Robert Wesley, “The Madrid Attacks: Results of Investigations Two Years Later,” Terrorism Monitor, Volume IV, Issue 5, March 9, 2006, 3. 1073 Gunaratna, 116. 1074 Ibid, 116. 1075 Atwan, 53. 1076 Bergen (2006), 155.
270
Al Qaeda enjoyed popular support in many locations and successfully co-opted
locals into providing intelligence support. There is not much evidence that locals
provided much counterintelligence support. However, the fact that al Qaeda could work
in a foreign theater without being ‘turned over’ to local law enforcement gave the group a
large counterintelligence advantage. Al Qaeda’s campaigns to generate popular support
occasionally gave away sensitive information about its personnel and plans.
Additionally, al Qaeda imperiled its relationship with the Taliban in its quest to generate
widespread support, which could have caused al Qaeda to lose its controlled territory—
arguably one of its most precious counterintelligence resources. Al Qaeda’s contact with
the media introduced counterintelligence vulnerabilities as the group interacted with
journalists by phone, Internet and in person.
Al Qaeda Timeline: 2001 – 2005
Al Qaeda: 2001 – 2003
Adversary Counterterrorism Capability. After 11 September 2001, the US
dramatically increased resources devoted to locating and destroying al Qaeda.
2001: US begins Operation Enduring Freedom
2001: Bin Laden gives his final interview to Al Jazeera
2002: Al Qaeda issues sixty public communications in support of its publicity push
2002: Al Qaeda regroups in Shahi-Kot Valley
2005: British Al Qaeda members indicted for surveilling buildings in NY
2002: Al Qaeda attacks in Kenya
2003: Al Qaeda attacks in Morocco, Saudi Arabia and Turkey
271
The US initiated Operation Enduring Freedom on 7 October 2001, in response to
the al Qaeda attacks in New York and Washington, DC. The US assembled a coalition of
24 countries to accomplish this mission. The campaign began with a series of air strikes,
while US intelligence personnel and special operations forces worked with the Northern
Alliance and with anti-Taliban Pashtun forces.1077 By 12 November, Coalition forces
took the capital, Kabul, and by 7 December had taken key Taliban strongholds in Kunduz
and Kandahar.
By March 2002, al Qaeda had regrouped in the Shahi-Kot Valley and Arma
Mountains southeast of Zormat. The US launched Operation Anaconda in order to
slowly squeeze al Qaeda forces in the region. US Predator drones circled the skies while
US and Afghan troops, along with soldiers from Canada, Australia, Denmark, France,
Germany and Norway swept through the mountains.1078
The US also increased its efforts to find and disrupt al Qaeda cells throughout the
world. The US began working more closely with liaison partners. Al Qaeda’s online
presence increased in this time period as well, and the US continued its efforts at
shutdown websites and chat rooms where al Qaeda was suspected of transmitting
information or propaganda to its operatives.
Shutting down all websites proved very difficult, however. Roger Cressey, former
NSC official for Counterterrorism in the Clinton Administration, depicted the futility of
the US’s cyber strategy arguing that the process was akin to a game of “whack-a-mole,”
1077 Byman (2005), 216. 1078 Wright, 372.
272
where al Qaeda could set up alternative websites with relative ease when one was shut
down.1079
Organizational Structure. Al Qaeda’s structure in the 2001 to 2003 period
became relatively loose as the core of the group in the Afghan-Pakistan border region
was essentially cut-off from its operatives deployed outside of Afghanistan. The al
Qaeda core in Afghan-Pakistan tribal areas continued to issue strategic and inspirational
direction to its some of its overseas operatives, though these individuals greater
operational and tactical autonomy.1080
The organizational structure of al Qaeda’s core probably remained hierarchical.
An internal al Qaeda document dated March 20, 2002 lays out the requirements for
joining the group, including: abiding by al Qaeda rules, obedience to leaders in charge
without disobeying Islamic rules, and no connection between al Qaeda membership and
any other Islamic group.1081 This indicates that al Qaeda retained a high degree of
command over its local membership.
Al Qaeda’s international operatives appear to have enjoyed increased autonomy,
though they continued to interact with the al Qaeda core. For example, Abdal Rahim al
Nishiri, the al Qaeda operative responsible for the USS Cole attack, continued to plan
terrorist operations in the Gulf, including the attack against a French oil tanker in October
1079 Interview with Roger Cressey. 1080 For the purposes of this case study, al Qaeda operatives are considered those who have some direct logistical, financial or communications connection to the al Qaeda core in the Afghan-Pakistan region. Individuals who were inspired by al Qaeda and adopted its mission, but did not have any logistical or material connection to the al Qaeda core, are not considered a part of al Qaeda. 1081 Harmony and Disharmony Exploiting al-Qa’ida’s Organizational Vulnerabilities, Document: AFGP-2002-600045.
273
2002.1082 Nashiri formed the idea of the attack, picked the target and his operatives, and
then asked for funds and the ‘green light’ from the al Qaeda military committee, which
was headed by Sayf al Adl.1083 The al Qaeda core used videos released to the media to
boost morale and provide strategic direction to operatives that it was able to maintain
regular contact with.1084
Resources: Local and International. Al Qaeda’s local and international resources
remained relatively high in the 2001 to 2003 period. Al Qaeda activity in this period
included attacks on the French oil tanker Limburg on 6 October 2002, an Israeli-owned
hotel in Kenya on 28 November 2002, the Cordoval Compound in Saudi Arabia on 13
May 2003, the Spain House and Jewish cemetery in Morocco on 16 May 2003, the
Muhaya Housing Compound in Saudi Arabia on 8 November 2003, and the HSBC Bank
and British Consulate in Turkey on 20 November 2003.1085
Locally, al Qaeda suffered an initial shock when its controlled territory in
Afghanistan was lost, but then regained controlled territory along the Afghan-Pakistan
border—though its new controlled territory did not begin to match the controlled territory
it enjoyed in Afghanistan. Al Qaeda continued to receive a good deal of financial
support, though the US moved to cut off its finances by freezing assets of al Qaeda and
Taliban affiliated individuals and charities. Al Qaeda’s videos continued to inspire
donors to contribute to the group’s mission. Al Qaeda’s finances also received a major
1082 Bergen (2006), 253. / The 9/11 Commission Report, 153. 1083 Bergen (2006), 253. 1084 Ben Venzke, “Evolution of Jihadi Video V1.0,” Intelcenter, 11 May, 2005, 9. 1085 IntelCenter, “al-Qaeda Operational Tempo – Madrid Follow-on Attack Assessment – v.1.0,” 14 March 2004.
274
boost after dropping its exorbitant annual donation to the Taliban government.1086 It is
unknown how much of these funds were redirected to tribal leaders in al Qaeda’s
controlled territory in the Afghan-Pakistan border region.
Al Qaeda members also managed to salvage some their high-tech equipment
following the US bombardment in Afghanistan in 2001. Hamed Mir, a Pakistani
journalist and Bin Laden’s biographer, reported that every other al Qaeda member fleeing
camps in 2001 carried a laptop computer with him.1087
Al Qaeda’s links and access to ‘international’ fighters were also degraded by the
US military action in Afghanistan. The US operation essentially eliminated al Qaeda’s
training and logistical infrastructure in Afghanistan, which made it much harder to train,
recruit and plan on the same scale as it had done previously.1088
Al Qaeda members overseas tried to make up for this deficit by relying more
heavily on indigenous resources in their areas of operation and training available on the
Internet. Saudi Arabia is one country that experienced marked growth in indigenous
support for al Qaeda. Operative Ahmed Omar Abu Ali offered his services to al Qaeda
operatives in Saudi Arabia in 2002. Al Qaeda members provided Abu Ali with training
in weapons and document forgery as well as funds for a computer and a cell phone.1089
Al Qaeda in Saudi Arabia also launched a newsletter, called Al Battar Military Camp
Publication, targeted at Saudis interested in joining the jihad against the Saudi regime.1090
1086 Byman (2005), 217. 1087 Atwan, 122. 1088 Burke, 232. / Byman (2005), 217. 1089 United States v. Ahmed Omar Abu Ali, Criminal No. 1:05CR53, Feb 2005.. 1090 Bergen (2006), 376.
275
The al Qaeda core’s connections to the Saudi branch are demonstrated by the regular
‘column’ the chief of al Qaeda’s military operations writes for Al Battar.1091
Al Qaeda also made up for its controlled territory deficit by creating a virtual
safehaven on the Internet, where it could communicate with its followers and provide
instruction on training, intelligence, and counterintelligence techniques. Before the 9/11
operation, al Qaeda had only one known website, www.alneda.com, but the group had as
many as fifty websites by 2006.1092 The Saudi branch of al Qaeda developed an online
training publication called Mu’askar al-Battar (Camp of the Sword). The first issue
encouraged those who could not travel to training camps saying: “in order to join the
great training camps you don’t have to travel to other lands…alone, in your home or with
a group of brothers, you too can begin to execute the program.”1093
Al Qaeda operatives also used the Internet to communicate with one another. As
late as 16 September 2002, al Qaeda cells in Western countries reportedly used Internet-
based phone services to communicate with operatives overseas.1094 In an internal al
Qaeda memo, operative Abu Huthayfa reports that electronic mail is good for sending
attachments up to 4MB in size and website such as www.driveway.com are good for
storing and transmitting files up to 100MB in size.1095
1091 Ibid, 376. 1092 Hoffman, 5. 1093 Hoffman, 10. 1094 Timothy Thomas, “Al Qaeda and the Internet: The Danger of ‘Cyberplanning’” Parameters, Spring, 112. 1095 Harmony and Disharmony Exploiting al-Qa’ida’s Organizational Vulnerabilities, Document: AFGP-2002-003251.
276
Popular Support: Local. Al Qaeda’s local support increased dramatically
following the US Operation Enduring Freedom. Al Qaeda’s exodus and relocation to the
Afghan-Pakistan border region was facilitated by local warlords in Afghanistan and by
the Pashtun tribes of the Pakistan frontier area.
Al Qaeda knew that fleeing its strongholds in Afghanistan was necessary when
Operation Enduring Freedom began. They chose to retreat to Tora Bora, a mountainous
fortress on the border of Pakistan.1096 The tribal leaders in Tora Bora, the Eastern Shura,
had the final word on what would happen to al Qaeda in Tora Bora.1097 The Eastern
Shura had a favorable view of Bin Laden and his cohorts, as they had brought commerce
and employment opportunities to Afghanistan during their tenure. As the US invasion
began, the Eastern Shura’s main interests were stability and defending fellow Muslims,
including members of al Qaeda, from invading forces.1098
To shore up al Qaeda’s popular base before moving to Tora Bora, Bin Laden held
a jirga with regional Pashtun elders on November 10, 2001 where he announced that al
Qaeda intended on fighting the US as its forces advanced across Afghanistan.1099 Bin
Laden’s close association with the Taliban, coupled with his mythical status as a hero of
the anti-Soviet jihad, afforded him additional support with the tribal elders.1100 The final
1096 Philip Smucker, Al Qaeda’s Great Escape: The Military and the Media on Terror’s Trail, (Brassey’s, Inc.: Washington DC, 2004), 57. 1097 Ibid, 45. 1098 Ibid, 46. 1099 Smucker, 51. 1100 Ibid, 52.
277
pillar in al Qaeda’s escape strategy was to pay off regional tribal leaders in return for
support against invading Western forces.1101
As Bin Laden moved east from the Mileva Valley to Tora Bora the core of his
close quarters guards consisted of sixty men, according to villagers in the area. In
addition to these bodyguards, a 400-man force acted as pickets on al Qaeda’s flanks.1102
While the US and its tribal allies fought up one side of the Tora Bora Valley,
tribesman loyal to Bin Laden were helping to smuggle al Qaeda members out of Tora
Bora into Pakistan. The Eastern Shura also facilitated the delivery of food to al Qaeda,
even while the US was bombing the area.1103
Al Qaeda continued to encourage Afghans to join al Qaeda during this time.
Appeals for support were circulated by covert ‘night letters’, as known as shabnama. The
distribution of ‘night letters’ was a psychological warfare technique taught to the Afghans
by the United States during the 1980s.1104 Taliban also put out night letters offering a
bounty for specific Special Forces personnel as well as for any foreigner.1105 Al Qaeda
provided clan leaders and local Pashtun village leaders with thick envelopes of Pakistani
Rupees in return for support.1106
Al Qaeda experienced setbacks in popular support during their exodus. Al Qaeda
member Fouad al Rabia recalls that group members could only stay in a stranger’s house
1101 Ibid, 50. 1102 Ibid, 72. 1103 Ibid, 80. 1104 Robin Moore, The Hunt for Bin Ladin: Task Force Dagger, (Random House: New York, 2003), 272. 1105 Ibid, 273. 1106 Corbin, 265-269.
278
for a couple of days because many villagers feared that renting a house to an Arab would
result in their being shot or bombed.1107 Fear of being bombed was reinforced when the
US bombed the Al Jazeera offices in Kabul. After the bombing, Al Jazeera decided not
to air any more al Qaeda videotapes.1108
Once al Qaeda escaped to the Afghan-Pakistan border region, they received an
additional measure of popular support. In both of the Pakistani provinces that border
Afghanistan, Baluchistan and the North West Frontier Province (NWFP), al Qaeda-
friendly Pashtun tribes were major players. These tribes subscribe to pashtunwali, a law
of the Pashtuns, which prizes hospitality and providing refuge to those in need.1109 The
border region stretched 1,500 miles—approximately the distance from Washington, DC
to Denver—and was riddled with Pashtun tribes.1110
Popular Support: International. Al Qaeda international popular support
continued to swell in the wake of the 9/11 attacks and Operation Enduring Freedom. Al
Qaeda restructured its public media efforts in 2002, becoming even more prolific in its
public outreach—al Qaeda issued sixty public communications in 2002 and twenty-nine
in 2003, in contrast to only four in 1999 and 2000.1111 Since the 9/11 attacks, Bin Laden
and Zawahiri have released an audio or video statement approximately once every six
weeks.1112
1107 Bergen (2006), 328. 1108 Corbin, 261. 1109 Bergen (2004). 1110 Bergen (2004). 1111 IntelCenter, “al-Qaeda Attack/Messaging Statistics v.1.0,” 22 August 2003, 10. 1112 Bergen (2006), 377.
279
Al Qaeda redoubled its public relations offensive soon after the US invasion of
Afghanistan. On the first day of the US bombing of Kabul, al Qaeda released a videotape
to Al Jazeera where Bin Laden and al Qaeda spokesperson Sulaiman Abu Ghaith called
for a religious war to drive Americans out of the Muslim world.1113 Al Qaeda had
anticipated US airstrikes and had the professionally edited video queued to go as soon as
the US campaign began.1114 Bin Laden gave his last television interview to Al Jazeera in
October 2001.1115 Atif telephoned Al Quds editor Atwan after the US bombed Tora Bora
to issue a communiqué to confirm Bin Laden had lived through the assault.1116
In part, the US invasion of Afghanistan was itself a source of increased support
for al Qaeda. Though the US endeavored to minimize collateral damage, the perception
of collateral damage was hard to eliminate. Media outlets reported large numbers of
villagers killed and civilian homes destroyed.1117 This allowed al Qaeda’s to cast itself as
the ‘David’ to the US’s ‘Golaith.’ Some of this support, however, was tempered by a
idea circulating in Islamic world that al Qaeda had ‘lost’ Afghanistan with its militant
provocation.
Al Qaeda used its website, www.alneda.com, to increase public support during
this time as well. The website published a list of names of eighty-four al Qaeda fighters
captured in Pakistan following their exodus from Afghanistan, presumably to let their
1113 Harmony and Disharmony Exploiting al-Qa’ida’s Organizational Vulnerabilities, Document: 2RAD-2004-600457. / Corbin, 260. 1114 Hoffman, 1. 1115 Bergen (2006), 321. 1116 Atwan, 25. 1117 Bodonsky, 283.
280
family members know they were still alive.1118 In February 2003, al Qaeda released the
fifth and sixth installment of Internet articles called In the Shadow of Lances, where Sayf
al Adl provided advice on how to employ guerrilla tactics against US forces in their
upcoming invasion of Iraq.1119 Al Qaeda members probably also used chat rooms and
online social networking services to connect to and communicate with jihadist
communities throughout the world.1120 Coupling dramatic video footage with digital
photographs, stirring music, and audio clips has most likely facilitated al Qaeda’s mission
to create a community of sympathizers all over the world.1121
Despite obvious difficulties, al Qaeda maintained contact with media personnel
and organizations. Al Qaeda sent an email to Al Quds in October 2002 to claim credit for
its attack on a French tanker in Yemen and again in November 2003 to claim credit for its
attacks in Istanbul.1122
Al Qaeda’s video production became more sophisticated during the 2001 to 2003
period. The video production branch of al Qaeda, called the Sahab Institute for Media
Production, was a professional video production outfit. Sahab would produce multiple
versions of videos with subtitles in various languages in order to increase its audience.1123
Sahab produced the al Qaeda video containing Bin Laden’s address to Americans and
1118 Thomas, 117. 1119 Bruce Hoffman, “Combating Al Qaeda and the Militant Islamic Threat” Testimony presented to the House Armed Services Committee, Subcommittee on Terrorism, Unconventional Threats and Capabilities on February 16, 2006. 1120 Corman, Steve R. and Jill S. Schiefelbein, “Communication and Media Strategy in the Jihadi War of Ideas,” Consortium for Strategic Communication, Arizona State University, April 20, 2006, 17. 1121 Hoffman, 16. 1122 Atwan, 120-121. 1123 Venzke,, 5 -32.
281
Muslims in Iraq, released to Al Jazeera on 18 October 2003.1124 Sahab probably helped
Bin Laden and Zawahiri make some of their twenty-six video statements between
January 2002 and July 2005.1125
For al Qaeda, the downside of its video campaign was the pressure it put on the
group to ‘deliver’ on attacks. Clinton Administration counterterrorism official Roger
Cressey argues that al Qaeda had to follow through on the attacks it was promising in its
videos or risk losing its street credibility. Cressey noted the tension this produced
between more operational elements of al Qaeda, such as Zarqawi’s branch in Iraq, and
the core leadership remaining in the Afghan-Pakistan border region.1126
Al Qaeda was careful to shape its message in the 2001 to 2003 period in order to
appeal to the largest possible audience. After the 9/11 attacks, al Qaeda began to appeal
directly to national groups subject to the greatest counterterrorism assault from the West,
such as Pakistan, Saudi Arabia, Iraq and the Palestinian territories.1127 Al Qaeda
continued to sell its mission as a religiously sanctioned defensive jihad—an act of self-
defense of Muslim lands in response to Western aggression.1128
At times, Bin Laden tried to portray himself as a statesman to make himself more
palatable to Western audiences and moderate Muslims.1129 This appears to have paid off.
In June 2003, the Pew Research Institute found that solid majorities in Indonesia, Jordan,
1124 Ibid, 33. 1125 Intelcenter, “al Qaeda Warning Cycle Completion for CONUS,” v1.1, 9 Dec 2005, 32. 1126 Interview with Roger Cressey. 1127 Blanchard, 5. 1128 Ibid, 6. 1129 Ibid, 5.
282
Morocco, Pakistan and the Palestinian territories believed that Bin Ladin would do the
right thing regarding world affairs.1130 Al Qaeda was also sensitive to the collateral
damage it created by its attacks on Western interests. For example, the Al Battar
Training Camp publication advised al Qaeda members to know the nationalities of the
likely victims of their attack, as “nationalities determine the effect of the operation.”1131
Intelligence: Local and International. There is a dearth of information about al
Qaeda’s intelligence capabilities in the 2001 to 2003 period, thought the group appears to
have continued to conduct intelligence collection in support of its international
operations.
Al Qaeda’s Internet-based intelligence training continued in this period. Sayf al
Adl wrote numerous articles that advised al Qaeda operatives on how to conduct
intelligence. The Al Battar Training Camp publication featured Al Adl articles on the
following topics: how to collect intelligence during conversations, how to set up a
safehouse, how to conduct an operational test for vetting weapons dealers, how to secure
a location using remote surveillance, and how surveillance operations can differ based on
the number of operatives involved.1132 Al Qaeda also made an appeal in 2002 on one of
its websites, www.alrakiza.com, for Muslims working at US airbases, naval bases,
seaports and airports in the Arabian Peninsula to provide intelligence to al Qaeda. The
website announcement asked ‘brothers’ to post information, including the location of US
1130 Steven Simon and Jeff Martini, “Terrorism: Denying Al Qaeda Its Popular Support,” The Washington Quarterly, Winter 2004-05, 6. 1131 Al Battar Training Camp: Issue 10, May. 23, 2004, Provided by SITE, RAND Voices of Jihad Database.. 1132 Al Battar Training Camp, Issues 6,9,14 and 16.
283
naval vessel refueling stations and the type fuel lines used at airbases, to the al Qaeda
website with photographs and scanned commercial maps.1133
Al Qaeda probably continued to blend into local environments to conduct
surveillance for its operations. The al Qaeda attack in Kenya in November 2002 was
preceded by months of surveillance by al Qaeda operatives posing as fishermen,
according to a UN report.1134
Espionage operations probably remained sporadic and opportunistic, as opposed
to systematic. Al Qaeda may have had a series of penetrations of the Saudi government
during this time. An al Qaeda computer recovered after the fall of Kabul contained some
secret Saudi government documents, presumably passed to al Qaeda by sympathetic
Saudi bureaucrats.1135 The al Qaeda operatives involved in the attack in Saudi Arabia in
2003 were alleged to have had very detailed knowledge of the Vinnell corporation’s
residential complex, suggesting the group had recruited sources in the Saudi National
Guard to provide information about the compound.1136
It is likely that al Qaeda members continued to use open sources to collect
information on targets. In 2005, British al Qaeda members were indicted on charges of
carrying out reconnaissance of targets in New York, Newark, New Jersey, and
1133 Http://www.alrakiza.com, accessed on November 19, 2002. 1134 Marc Lacey, “Terrorists in Kenya Killings Posed as Fishermen,” The New York Times, November 6, 2003. 1135 Anonymous, Imperial Hubris: Why the West is Losing the War on Terror, (Brassey’s, Inc: Washington, DC, 2004) 72. 1136 “US Intelligence: Al Qaeda Infiltrated Saudi Arabia’s Elite National Guard,” Al Bawaba, May 19, 2003.
284
Washington, DC. The men allegedly videotaped the targets and collected over 500
photographs of the targets, many of which they downloaded from the Internet.1137
Counterintelligence: Local. Al Qaeda’s local counterintelligence procedures
remained high, and probably improved, in the 2001 to 2003 period.
Al Qaeda continued to demand that its recruits uphold an agreement to secrecy.
An internal ‘contract’ between al Qaeda and its recruits, dated March 2002, stipulates that
members cannot talk about work assigned in al Qaeda with other al Qaeda members, with
the exception of their ‘direct’ commander.1138 The same document outlines the
responsibilities of al Qaeda’s security committee, which include providing necessary
security for operations, promoting the feeling of security among personnel, and
facilitating the administrative security procedures related to the host country.1139 The
promotion of the “feeling of security” may relate to the cultivation of a
counterintelligence awareness among its members to reduce espionage and information
leakage problems.
The same internal document also describes the duties of al Qaeda’s
counterespionage section and its installations, personnel and facilities security section.
The counterespionage group, referred to as the Central Section, was responsible for
uncovering espionage and penetration operations by the enemy, penetrating the enemy’s
1137 Hoffman, 12. 1138 Harmony and Disharmony Exploiting al-Qa’ida’s Organizational Vulnerabilities, Document: AFGP-2002-600045. 1139 Ibid.
285
defenses through agent recruitment, monitoring everything in the media related to al
Qaeda’s work, and filing all gathered data either on paper or computer.1140
The facilities protection section, referred to as the Organizational Work Security
Section, was responsible for al Qaeda leaders’ protective detail, guarding al Qaeda’s
documents and facilities, conducting background checks on personnel handling sensitive
documents, and selecting suitable locations for secure work facilities.1141 Interestingly, al
Qaeda seems to have weighed the risk of keeping soft and hard copies of files and
decided that it was better to keep them.
Al Qaeda continued to use videos to promote its message despite the risks
associated with producing and delivering such material to non-al Qaeda personnel. One
strategy they probably employed to reduce the information leakage risk was to minimize
the time between the delivery of a videotape and its airing. Al Qaeda videotape experts
at the Virginia-based government contractor IntelCenter contend that typically videotapes
were aired within two days of their being delivered to the media outlet.1142
To keep core al Qaeda operatives from exposing themselves to enemy law
enforcement, lower-level members were used for logistical tasks, delivering messages by
hand, and inputting Internet messages and communications at Internet cafes. Al Qaeda
operative Iyman Faris was reported to have helped al Qaeda members arrange travel to
Yemen by visiting a travel agency disguised as a member of Tablighi Jamaat.1143
1140 Ibid. 1141 Ibid. 1142 Ibid. 1143 US v Iyman Faris, Statement of Facts, United States District Court for the District of Eastern Virginia, Criminal Case.
286
Internet communications were also handled through lower-level members. Al
Qaeda leaders would record a communication on a disk and then send a low-level
operative to upload the material on a computer at a cyber café.1144 Allegedly, the core of
al Qaeda does not use the Internet directly for fear of being caught or tracked.1145
Al Qaeda’s local security also received a boost as a result of their newfound
controlled territory in the Afghan-Pakistan border region. Not only is the region remote
and free of Pakistani and Afghan Government control, but non-tribal entities in the region
are easily identified by locals. Pakistan journalist Yusufzai reported that outsiders stick
out immediately in the tribal region, so that non-locals, and even Arabs, find it difficult to
hide there.1146 Journalist Peter Bergen points out that even without the anti-US
sentiment in the region, finding a few al Qaeda members in this vast area is a daunting
task. He describes how thousands of NATO soldiers spent more than a decade
unsuccessfully hunting Bosnia-Serb war criminals in Bosnia, an area less rugged than and
only two-thirds the size of the Northwest Frontier Province.1147
Al Qaeda’s connections to the Pashtun tribes in the region afforded them even
greater security as a result. The group’s ties with the chiefs of southern Afghan heroin-
trafficking networks may have allowed them to move fighters across the Afghanistan-
Iran and Afghanistan-Pakistan borders.1148 It is telling that despite the $100 million
reward offered by the US for information leading to the capture of Bin Laden, not a
1144 Atwan, 130. 1145 Ibid, 130. 1146 Bergen (2004). 1147 Bergen (2006), 395. 1148 Anonymous, 64.
287
single person stepped forward to offer such information.1149 Part of this reticence may
result from al Qaeda’s popularity and willingness to pay off locals. One tribal elder
reported to a journalist: “Osama and his men are heroes for locals…They are treated as
honorable guests. They don’t harm tribesmen, stay for a couple of nights, and pay [$175
to $300] before they leave.”1150
Despite its improving counterintelligence tradecraft, al Qaeda faced a number of
setbacks in the 2001 to 2003 period. First, the group continued to give away sensitive
information about its personnel and locations in its videos. In one al Qaeda video,
operatives are seen close-up in some rugged mountain setting with their faces and
communications equipment in full view.1151 While this doesn’t give away their exact
location, intelligence services could use the information assess the group’s general
location, communication modus operandi and overall physical and financial health. For
example, one tribal elder in Warizistan commented to a journalist: “The footage I saw on
a local TV channel, looked to me like our area…Osama was wearing a Waziristani
woolen cap, shalwar kameez, and a scarf on his shoulder. The dress is of here and the
terrain is familiar; I have walked these mountains all my life.”1152
In a video released on 27 December 2001, Bin Laden appeared gaunt and was not
moving his left arm, probably as a result of injures from US strikes against al Qaeda. The
1149 Ibid, 51. 1150 Owais Tohid, “Tribesmen Take Cash, Count Blessings from Al Qaeda,” The Christian Science Monitor, October 29, 2003. 1151 Venzke (2006).. 1152 Owais.
288
video, in theory, would allow al Qaeda’s adversaries to assess his health and perhaps
speculate on the accuracy of intelligence they had received leading to the air strikes.
More recently released videotapes of Bin Laden give the impression that he is not
living in a remote tribal region but that he is in a secure, comfortable location where he is
able to follow political developments with some ease.1153 This information could be
valuable to intelligence services that are tracking Bin Laden’s location based on small
clues such as these.
Second, al Qaeda risked exposure by trying to get its publicity products to media
organizations. A recent al Qaeda video featured an interview in English with operative
Abdullah al-Amriki and was delivered to ABC News via a source known to have contacts
with al Qaeda in the tribal region of Pakistan.1154 As journalist Peter Bergen notes, it is
possible to exploit these contacts and sources by tracing the series of handoffs that must
occur for the media product to reach the final source.1155 Allegedly, a number of minor
operatives have been arrested after being spotted on CCTV uploading al Qaeda
communications at Internet cafes.1156
Counterintelligence: International. Al Qaeda’s international counterintelligence
procedures probably remained high in the 2001 to 2003 period, as the group seemed to
capitalize on the counterintelligence advantages afforded by the Internet for
communication and training.
1153 Atwan, 229. 1154 Intelcenter, “al Qaeda Warning Cycle Completion for CONUS,” v1.1, 9 Dec 2005, 27. 1155 Bergen (2004). 1156 Atwan, 130.
289
Al Qaeda continued to use code systems to communicate with its operatives.
Operative Iyman Farris reported that he relayed information to his al Qaeda managers by
referring to gas cutters as “gas stations” and special operational equipment as “mechanics
shops.”1157 For an additional measure of communications security Farris’ manager
instructed him to access email only after opening other Internet sites first and never
immediately after logging in.1158
Al Qaeda’s loose organizational structure probably helped the group to evade
some surveillance of its coded communications. According to Canadian al Qaeda
operative Mohammed Monsour Jabarah, captured in 2002 by Canadian authorities, code
words were generally established by individual cells.1159 This would make it difficult for
law enforcement to scan communications for a discrete number of ‘standard’ code words.
Al Qaeda members also employed some counterintelligence procedures when
dealing with journalists. When Al Jazeera journalist Yosri Fouda met with KSM and
Binalsheibh in Pakistan in 2002, Fouda first had to meet an intermediary outside Karachi
and was then blindfolded and driven to a safehouse before meeting the al Qaeda
leaders.1160
Al Qaeda used the Internet to maintain the international reach of its media and
operational campaigns while retaining a level of secrecy. During and immediately
following Operation Enduring Freedom, al Qaeda used www.alneda.com to boost morale
1157 US v Iyman Faris, Statement of Facts, United States District Court for the District of Eastern Virginia, Criminal Case. 1158 Ibid. 1159 Bergen (2006), 274. 1160 Ibid, 302.
290
among its operatives and gain new support from sympathizers throughout the world.1161
This website was operational irregularly through 2002, jumping from one Internet service
provider to another as the US government tried to shut it down completely. In one eight
week period it moved from a provider in Malaysia, to one in Texas, and finally to one in
Michigan before being cut off.1162 In the cyber game of “cat and mouse,” the difficulty of
shutting even a single website down permanently is a testament to the current security
advantage afforded to the “mouse.” Perhaps the greatest natural advantage the Internet
provides is its size. London based Saudi dissident Mohammed al-Masri points out that,
“nine hundred million people use the Internet annually…it is impossible to keep it under
random surveillance.”1163
Al Qaeda may have adapted to some law enforcement techniques for tracing
communications. Al Quds editor Atwan argues that some members may use one-time
email accounts or pass messages through a shared email account.1164 This would thwart
law enforcement efforts to monitor a suspect email account or intercept emails passed
between accounts. Short-life websites, perhaps open for only a few hours, may also be
used to pass information, thereby avoiding a direct email-to-email communication.
Atwan argues that al Qaeda members probably do not need to encrypt their website and
chatrooms, relying instead on the jihadi visitors “sixth sense” of what is being
communicated through the text and various signposts.1165 This would thwart law
1161 Hoffman, 7. 1162 Ibid, 8. 1163 Atwan, 130. 1164 Ibid, 133. 1165 Ibid, 135.
291
enforcement efforts to casually drop into a website forum and pick up hidden messages
without a substantial background on the forum.
Sayf al Adl wrote numerous articles that advised al Qaeda operatives on
counterintelligence practices. The Al Battar Training Camp publication featured Al Adl
articles on the following topics: how to develop an effective cover, how to write and
classify intelligence reports, how to physically secure sensitive information and
documents, when to be particularly wary of monitoring by the adversary, and how to
communicate with a limited number of coded references in order to avoid raising
suspicion.1166
Al Qaeda suffered from a number of counterintelligence vulnerabilities in the
2001 to 2003 period. First, al Qaeda’s increased media efforts required it to raise its
operational profile on numerous occasions. Al Qaeda’s media efforts require that it have
regular access to videocameras, videotapes, production equipment, computers, editing
equipment, and the Internet.1167 These efforts could potentially expose al Qaeda
members to law enforcement as they monitor the signatures and footprints left by the
purchase and use of such material. Some of al Qaeda videos display a distinctive mark,
known as a ‘bug’ to indicate which media shop produced the video. Al Qaeda’s Sahab
Institute for Media Production, for example, has a unique bug that indicates the
production group has handled and edited the video.1168
1166 Al Battar Training Camp Publication, Issues 3, 10, 16, and 22. 1167 Hoffman, 1. 1168 Venzke, 12.
292
Some al Qaeda operatives came out of hiding to give media interviews.
Binalsheibh, for example, granted an interview to Al Jazeera in 2002 while he was hiding
in Karachi.1169
Al Qaeda has also been exposed to second-hand monitoring via its associations
with non-al Qaeda intermediaries and international media organizations, who are easier
for governments to monitor. Increased monitoring occasionally deterred media
organizations from dealing with al Qaeda at all. An internal al Qaeda memo described
the difficulty al Qaeda was having finding volunteers to distribute the group’s
propaganda in the Gulf due to security pressure from the governments in the region.1170
Al Qaeda videos in the 2001 to 2003 period were occasionally held in clearing
houses, often based in London, from where they would be distributed internationally.
Those managing these clearing houses were easily monitored and some may have been
arrested and prosecuted.1171 When authorities cannot track down al Qaeda’s
intermediaries, they can often track al Qaeda’s interactions with larger media
organizations. For example, British police raided Al Quds’ offices in London after the
newspaper received an email from a suspected al Qaeda operative in the wake of the
Madrid bombings.1172
Second, al Qaeda’s loss of controlled territory generated both counterintelligence
advantages and vulnerabilities. While the volunteers could no longer be traced to al
1169 Burke, 223. 1170 Harmony and Disharmony Exploiting al-Qa’ida’s Organizational Vulnerabilities, Document: AFGP-2002-003251. 1171 Kohlmann, Evan F. “The Real Online Terrorist Threat,” Foreign Affairs, September 2006 - October 2006, Pg. 115 Vol. 85 No. 5. 1172 Atwan, 121.
293
Qaeda through visits to training camps in Afghanistan, it is likely that the lack of formal
training caused operatives’ security tradecraft to suffer. In addition, al Qaeda members
that are known to have visited Afghanistan before Operation Enduring Freedom are still
hounded, and sometimes arrested, by intelligence services throughout the world.1173 The
loss of a controlled territory may also adversely impact the fervor and dedication of the
next generation of al Qaeda recruits. Terrorism expert Brian Jenkins argues that,
“televised videotapes and virtual realms on the Internet may not suffice to maintain a
high level of devotion.”1174 A decrease in secrecy and security would likely accompany
such a decline in devotion and commitment to the movement.
Third, al Qaeda’s increase in organizational looseness generated both
counterintelligence advantages and vulnerabilities. Though operatives have fewer
connections to al Qaeda operatives known or monitored by law enforcement, their
security tradecraft likely suffers as a result of increasingly self-managed training. In
addition, al Qaeda’s core must rely on less secure and more open channels for mass
communicating with operatives whose access to secure websites and connections to other
operatives is ambiguous.1175
Summary. After 11 September 2001, the US began to devote increasing amount of
its resources to locating and destroying al Qaeda. Al Qaeda’s structure in the 2001 to
2003 period became relatively loose as the core of the group in the Afghan-Pakistan
1173 Combating Terrorism Center Department of Social Sciences United States Military Academy, Harmony and Disharmony Exploiting al-Qa’ida’s Organizational Vulnerabilities, February 14, 2006., 21. 1174 Brian Michael Jenkins, Countering Al Qaeda, Santa Monica, CA: RAND, 2002), 10. 1175 Combating Terrorism Center Department of Social Sciences United States Military Academy, 33.
294
border region was essentially cut-off from its operatives deployed outside of Afghanistan.
Al Qaeda’s local and international resources remained relatively high in the 2001 to 2003
period, and the group’s local popular support increased dramatically following the US
Operation Enduring Freedom. Al Qaeda’s exodus and relocation to the Afghan-Pakistan
border region was facilitated by local warlords in Afghanistan and by of the Pashtun
tribes of the Pakistan frontier area. Al Qaeda’s international popular support also swelled
in the wake of the 9/11 attacks and Operation Enduring Freedom. Al Qaeda appears to
have continued to conduct intelligence collection in support of its international
operations. The group’s local counterintelligence procedures remained high in the 2001
to 2003 period, despite encountering new local security and counterintelligence
challenges. Al Qaeda’s international counterintelligence procedures probably remained
high in the 2001 to 2003 period.
Al Qaeda enjoyed popular support in many locations and probably co-opted locals
into providing intelligence support, especially in places like Yemen, Saudi Arabia and
Indonesia. Al Qaeda’s campaigns to generate popular support continued to offer its
adversaries sensitive information about its personnel and plans. Additionally, the group’s
contact with the media continued to introduced counterintelligence vulnerabilities. Al
Qaeda’s decentralization probably enhanced some aspects of its counterintelligence by
diversifying the sources of its publicity campaign and the methods and codes of its
international cells.
295
Hypotheses Revisited
Hypothesis 1(A): With a relatively tighter command and control structure al
Qaeda will have superior counterintelligence training and compartmentation. This is
correct. In Sudan and Afghanistan before October 2001, al Qaeda trained its members in
intelligence and counterintelligence techniques and every member leaving an al Qaeda
camp was assured to have a basic competence in guerrilla fighting. When al Qaeda had a
surfeit of recruits in 1999, Bin Laden insisted that every recruit attend the training camps,
regardless of overcrowding. Al Qaeda’s tight structure also allowed select members to
train heavily in one intelligence or counterintelligence skill and serve as a specialist for
the group. Jamal al-Fadl, for example, served as Bin Laden’s chief of security. After
October 2001, however, al Qaeda had to rely more on Internet based training guides and
operational publications like Al Battar to provide worldwide operatives with a basic
understanding of intelligence and counterintelligence procedures.
Hypothesis 1(B): With a relatively tighter command and control structure al
Qaeda will be more vulnerable to its adversary’s efforts to develop high-level
penetrations and exploit the group’s standardized counterintelligence procedures. This is
mostly correct. When al Qaeda had a looser structure, cells were responsible for devising
a set of codes to communicate with cell members. With cell-based code selection, the
discovery of one cell’s codes would not necessarily compromise another cell codes. Al
Qaeda’s tight organization in period one caused a major counterintelligence setback when
al Qaeda turncoat al-Fadl was able to describe many details of the group’s international
organization to US authorities in 1996. Al Qaeda’s international structure was generally
296
looser than its local structure. In period two, this allowed cell members in Yemen to
search for targets of opportunity in Aden Harbor rather than relying on top down target
selection. However, given that the Yemen cell had to report regularly to al Qaeda leaders
in Afghanistan, the system’s tightness imposed some constraints on innovation.
Hypothesis 2(A): With relatively greater popular support al Qaeda will have
greater counterintelligence support from the local population. This is mostly correct.
Before al Qaeda gained international notoriety it sent a core group member to do its
intelligence collection for the US Embassy attacks. After it gained popular support it was
able to exploit local networks to gather intelligence. For example, the US serviceman
who provided details to al Qaeda through a website was gathering intelligence on US
ships because he was an al Qaeda sympathizer. There is some evidence that al Qaeda
continued to use its extensive Internet presence to solicit anonymous intelligence from
sympathizers after 9/11. Al Qaeda presumably used the international recruits it trained in
Afghanistan to conduct intelligence as they returned to their home countries. Though al
Qaeda did not enjoy local popular support in Sudan, the group was given access to the
government’s Delegation Office, which allowed al Qaeda to collect valuable intelligence
and counterintelligence data on the local population. There is some evidence that al
Qaeda used its international contacts to spot and vet new members, such as it did in
mosques in Saudi Arabia.
Hypothesis 2(B): With relatively greater popular support al Qaeda will be more
likely to expose itself in its efforts to maintain popular support. This is correct. Bin
Laden routinely leaked valuable information about his health, locations, and operational
297
intentions in video interviews and tapes released to media organizations. Al Qaeda
leaders were in frequent contact with journalists, media organizations, and group
members in the West liaising regularly with the media. Zawahiri was on the telephone
with a Pakistani journalist immediately before and after the US cruise missile strikes in
Afghanistan in 1998. From 1998 to 2000, al Qaeda members made over 200 calls to
Fawwaz to coordinate the group’s media strategy. Any of these calls could have given
away valuable information about the group’s location and plans. In one case, al Qaeda
transmitted a message detailing the nationality and location of an operative before he
performed his suicide mission in order to get an immediate press release after the attack.
Al Qaeda planners might argue that this is a risk worth taking, as popular support
is the most important component of waging a guerrilla war. It is important to note that
the evidence offers examples of potentially exploitable vulnerabilities, as opposed to
vulnerabilities that were necessarily exploited by al Qaeda’s adversaries. Al Qaeda’s
potential vulnerabilities are a purer measure of its counterintelligence deficits, as the
vulnerabilities that are actually exploited represent the nexus of the adversaries’
capabilities and the group’s vulnerabilities.
Hypothesis 3(A): With relatively more controlled territory al Qaeda will have
superior communications security, physical security and counterintelligence vetting.
This is mostly correct. Al Qaeda leaders were trailed by an armed coterie, which would
have made an assassination or seizure operation difficult. Bin Laden was able to change
his abode every evening, lowering the chances he could be tracked by a single informant
and targeted for a missile strike. Al Qaeda members in the group’s Afghanistan camps
298
were well-protected from exposure to ‘outsiders’. Even well-known journalists, such as
John Miller and Peter Bergen, had to go through an extensive vetting procedure before
getting access to the camps. In contrast, al Qaeda members giving interviews and
meeting with media organizations in Pakistan (such as KSM) and London (such as
Fawwaz) did not have access to such controlled meeting and vetting procedures. Al
Qaeda’s communications security was also better in its controlled territory. Members
could meet face-to-face and did not have to rely on means of communications that could
be intercepted.
Hypothesis 3(B): With relatively more controlled territory al Qaeda will be more
vulnerable to its adversary’s efforts to track the group’s gross financial, logistical and
personnel movements. This is mostly correct. Al Qaeda’s large presence in Afghanistan
would allow its adversary the ability to observe the relative size and activity of its known
training camps remotely. Individuals passing into and out of the training camps could
also be subject to scrutiny simply based on the fact that they were traveling to
Afghanistan and Pakistan.
Hypothesis 4: Al Qaeda will become increasing centralized and tightly
commanded over time in the face of external threats. This appears to be correct. Al
Qaeda fostered a tight organizational structure and developed towards greater
compartmentalization and hierarchy between periods one and two. Al Qaeda become
loose again in period three, but not by choice. Following the US strikes in Afghanistan,
al Qaeda was forced to decentralize as communications with international operatives was
made impossible.
299
Control Variables: Alternative Explanations Review
As discussed earlier, the control variables do not remain perfectly constant in the
al Qaeda case study, opening up the possibility that the control variables account for
some of the change in the dependent variables.
First, the counterintelligence weaknesses that occurred in period two may result
from the increase in adversary strength from periods one to two, rather than al Qaeda
increased campaigning for popular support. However, while al Qaeda’s adversary may
have become more capable of exploiting the counterintelligence weaknesses created by al
Qaeda’s popular support campaigns, al Qaeda’s exposure through the media increased
dramatically. Whether its adversaries fully exploited that exposure is unknown.
Regardless of the adversary’s actions, al Qaeda created very real counterintelligence
weaknesses as a result of its media activities.
Second, it is possible that normal organizational learning accounted for al Qaeda’s
counterintelligence improvements over time. It is possible that irrespective of an increase
in popular support, al Qaeda operatives learned over time how to tap into indigenous
support networks and recruit non-al Qaeda members to conduct intelligence and
counterintelligence tasks for the group. By this logic, we should expect that al Qaeda’s
ability to locate and recruit indigenous intelligence assistance should increase steadily
over time and major increases in international popular support should not significantly
increase the level of assistance. Contrary to this expectation, al Qaeda’s local intelligence
support increased markedly soon after it began its global support campaign.
300
On the other hand, experience most likely did improve al Qaeda’s ability to
conduct effective intelligence operations overseas. For example, al Qaeda operatives
used the Internet creatively to recruit a USS Benfold serviceman. However, the
increasing skill of al Qaeda operatives was only effective because local sympathy for al
Qaeda was on the rise. In the case of al Qaeda in Saudi Arabia, the group’s operations
skyrocketed in part because al Qaeda seemed to be receiving a volume of intelligence
from sympathizers within the Saudi government and security services.1176 Ideally, the
alternative hypothesis would be tested in an environment where al Qaeda’s popular
support was decreasing while its skills were increasing. Unfortunately, al Qaeda’s
popularity has only increased since it began its global support campaign in 1996.
Improvements to al Qaeda intelligence and counterintelligence capabilities during
period three could result from al Qaeda’s relatively looser organizational structure, rather
than from increased levels of international and local popular support. As noted in the
analysis of hypothesis five, al Qaeda’s looseness in period three probably increased
innovation at the cell level. For example, al Qaeda’s ability to diversify its coded
communications may have given it an advantage in evading law enforcement
organizations. Evading law enforcement could have resulted in an increased ability to
clandestinely locate and recruit indigenous intelligence assistance. However, al Qaeda’s
key intelligence improvements in period three, including the ability to blend into
sympathetic communities and recruit local government officials, stemmed mostly from a
1176 Anonymous, 72.
301
growing international sympathy for the group’s objectives, not from a dramatic increase
in superior tradecraft.
Lessons from the al Qaeda Case Study
The al Qaeda case study provides support for several hypotheses and provides
insight into potential interactions between the independent variables and between the
intelligence and counterintelligence variables.
First, there is a natural tension between international and local
counterintelligence. The most important tension arises as the group campaigns to
increase its international popular support. On the one hand, international popular support
brings the group increased funds, recruits, and intelligence and counterintelligence
capabilities. On the other hand, the process by which a group generates international
popular support often causes the group to expose itself to its support base and through
contact the media. Additionally, local security precautions can sometimes introduce
international counterintelligence vulnerabilities. For example, al Qaeda members were
told to disperse from camps before major attacks, which could have compromised
operational security for international cells had al Qaeda camps been penetrated or
monitored at the time.
Second, a tight command structure introduces serious disadvantages for an
organization conducting global terrorist operations. On the one hand, a tight command
allows terrorist leaders to exercise more control over their organization, perhaps
mandating counterintelligence training and coordinating counterintelligence efforts.
However, communications security is a fatal weakness of a tightly controlled global
302
group. As a group spreads out across the globe face-to-face communication becomes
more difficult and communications migrate to cell phones, email, the Internet, or courier.
Using couriers becomes an impractically slow form of communication as distances grow,
but remains the most secure after face-to-face meetings. Additionally, relying on couriers
can become impractical if the group’s supply of trusted couriers becomes limited. By
covertly undermining a terrorist group’s confidence in its couriers, counterterrorism
practitioners would almost certainly slow the transmission of messages, materials, and
funds.
Just as al Qaeda did in the 1990s, terrorist groups that wish to retain control over
their global operations will most likely opt for a “centralization of decision and
decentralization of execution” model. In this model, communication with global cells
occurs in infrequent, short bursts.
Third, state sponsorship provides many intelligence and counterintelligence
benefits to terrorist group, but also provide exploitable vulnerabilities. A key
vulnerability is that terrorist groups sometimes share with their state sponsor information
about their leaders, personnel, facilities, training and military capabilities. Thus, an
adversary that cannot infiltrate the terrorist group may gain access to such information
through penetrations of the state sponsors security and police service, whose members
may be more susceptible to standard recruitment techniques.
Fourth, terrorist links to family members offer another exploitable vulnerability.
When Bin Laden moved al Qaeda to Sudan in 1991, he brought with him his four wives
and seventeen children. This provides a number of intelligence recruitment and
303
monitoring targets for an adversary’s intelligence apparatus. Though terrorist may be
portrayed as cold-hearted killers, they are also human in their need to maintain closeness
with their friends and family. Is it interesting to note that an Israeli assassination squad
killed Ali Hassan Salameh, the famous Black September terrorist, as he visited his niece
in Beirut on her birthday. Counterterrorism practitioners should recognize that a
terrorist’s relatives are the proverbial waterhole to which the terrorists will periodically
return.
304
CHAPTER FIVE: THE EGYPTIAN ISLAMIC GROUP
In the early 1990s, the Egyptian Islamic Group (IG), also known as Gamaa al-
Islamiyya, enjoyed widespread popular support in Egypt. IG’s attacks on the tourism
industry and Egyptian security forces left the Egyptian Government struggling to fight
back. By the end of the decade, IG lost most of its popular support and many of its key
leaders and operatives had been killed or imprisoned. Resigned to defeat, the group
agreed to a ceasefire with the Egyptian government in 1998. After enjoying such great
success in the early 1990’s, why did IG collapse so quickly?
The case study will show that IG collapsed because the Egyptian Government
made dramatic improvements in its counterterrorism capabilities while IG lost critical
popular support as a result of audacious and unpopular attacks on civilians and the
tourism industry. The case provides a good test of Hypothesis 2A and 2B. The large-N
data set offered preliminary support to these hypotheses, but the IG case offers an in-
depth look at the causal mechanisms driving the relationships between
counterintelligence and popular support. The case also highlights a number of interesting
dynamics between counterintelligence, popular support and adversary’s counterterrorism
capabilities.
In this chapter, I first provide a discussion of the key hypotheses and alternative
hypotheses, followed by the IG case study. I then review the hypotheses and alternative
hypotheses, and provide a general assessment of the practical and theoretical lessons that
the IG case offers.
305
The IG case study is broken into two parts. The first part depicts IG from 1989 to
1993, when the group faced a relatively weak Egyptian security force while enjoying
widespread popular support, particularly among young men with middle or lower-middle
class and rural or small town background. The second part depicts IG from 1994 until its
collapse in 1998, when the group faced a much stronger Egyptian Government while its
popular support slipped away.
IG Case Study Core Hypotheses
Hypothesis 1(A): With a relatively tighter command and control structure IG will
have superior counterintelligence training and compartmentation.
Hypothesis 1(B): With a relatively tighter command and control structure IG will
be more vulnerable to its adversary’s efforts to develop high-level penetrations and
exploit the group’s standardized counterintelligence procedures.
Hypothesis 2(A): With relatively greater popular support IG will have greater
counterintelligence support from the local population.
Hypothesis 2(B): With relatively greater popular support IG will be more likely to
expose itself in its efforts to maintain popular support.
Hypothesis 3(A): With relatively more controlled territory IG will have superior
communications security, physical security and counterintelligence vetting.
Hypothesis 3(B): With relatively more controlled territory IG will be more
vulnerable to its adversary’s efforts to track the group’s gross financial, logistical and
personnel movements.
306
Hypothesis 4: IG will become increasing centralized and tightly commanded over
time in the face of external threats.
Alternative and Falsifiable Hypotheses
The alternative hypotheses argue the opposite of the core hypotheses. Thus, the
first alternative hypothesis is that tighter organizational structure will not produce
superior counterintelligence training and compartmentation or greater vulnerabilities to
high-level penetrations. Conversely, if the group has a loose organizational structure but
does not suffer from inferior counterintelligence training and compartmentation, then the
alternative hypothesis is correct and the core hypothesis is falsified.
The second alternative hypothesis is that controlled territory will not result in
greater physical and communications security or greater vulnerabilities to tracking the
group’s gross movements of personnel and logistics. Thus, if the group operates from
controlled territory but does not benefit from more secure communications and vetting,
then the alternative hypothesis is correct and the core hypothesis is falsified.
The third alternative hypothesis is that popular support will not result in greater
counterintelligence support from the local population or greater vulnerability to exposure
in the media. Thus, if the group wages a popular support campaign but does not induce
counterintelligence vulnerabilities as a result and does not benefit from increased local
support, then the alternative hypothesis is correct and the core hypothesis is falsified.
The fourth alternative hypothesis is that a terrorist group facing an increasing
menacing adversary will not become more centralized and tightly commanded over time.
Thus, if the group faces an increasing threat from its adversary but does not centralize its
307
decision-making and tighten its command and control, then the alternative hypothesis is
correct and the core hypothesis is falsified.
Control Variables: Alternative Explanations
The control variables do not remain perfectly constant in the IG case study,
opening up the possibility that the control variables account for some of the change in the
dependent variables. First, the Egyptian Government increased its counterterrorism
capabilities dramatically between the first period (1989-93) and second period (1994-98).
Any erosion in IG’s counterintelligence capabilities could result from this shift, rather
than shifts in organizational structure, popular support or controlled territory. For
hypothesis one, IG’s counterintelligence training may remain weak over time as a result
of the adversary’s increasing counterterrorism capability, rather than as a result of IG’s
loose command structure. For hypothesis two, IG’s vulnerability to being monitored and
tracked around its territory may increase over time as a result of the adversary’s
increasing capabilities. For hypothesis three, IG’s reduced counterintelligence support
from the local population may result from a more capable adversary, rather than from
lower overall popular support.
The IG case provides a good test of hypothesis four—the adversary’s capabilities
are increasing steadily over time, which should lead directly to a tighter and more
centralized command structure.
The Islamic Group’s resources are held constant over the two periods, reducing
the likelihood that shifts in resources are accounting for the changes in
counterintelligence strengths and vulnerabilities.
308
IG Case Study: Dependent Variables
Islamic Group
Adversary CT
Capability
Org Structure
Resources
Controlled Territory
Popular Support Type
1989 - 1993 Low Low High Yes High 15
1994 - 1998 High Low High Yes Low 12
Islamic Group: Background
IG began as an umbrella organization for a loose association of militant student
groups.1177 Operating mostly in mosques and on university campuses, IG flourished in
Egypt when prominent Islamic organizations, such as the Muslim Brotherhood,
renounced violence in the 1970s. IG’s goal was to overthrow the Egyptian Government
and replace it with an Islamic government based on Islamic shari’a law.1178 Preaching in
mosques and drawing its members from universities and from impoverished
communities, the group became a renowned social movement. IG’s popularity in Upper 1177 Islamic Gema’at groups, a more or less generic term for Islamic student groups, have existed in Egypt since the 1960s but they are not organizationally connected to the IG that emerged in the 1980s. 1178 Nachman Tal, “Islamic Fundamentalism: The Case of Egypt and Jordan”, (Tel Aviv: University of Tel Aviv, 1999), 45.
309
Egypt was particularly widespread and provided the foundation for what IG hoped would
be a mass-based movement. In 1989, the leaders of IG formed a military wing for the
purpose of spearheading a violent revolution in Egypt.
Islamic Group Timeline: 1989 - 1993
Islamic Group 1989 - 1993
Adversary Counterterrorism Capability. The Egyptian Government was the IG’s
chief adversary throughout the group’s lifespan. The Egyptian Government had battled
numerous domestic opposition groups for decades, including the secretive and very
capable Muslim Brotherhood.1179 Through hard-earned experience the Egyptian
Government had developed expertise in how to address such threats. Despite this
expertise, the Egyptian Government responded in a heavy-handed fashion to IG in the
first period, perhaps overwhelmed by a sharp increase in violent opposition from multiple
1179 While the Muslim Brotherhood fluctuated between violent and nonviolent resistance strategies, the group ultimately settled on an essentially nonviolent strategy, due in part to the efforts of its very capable state adversary.
1989: Military wing formed
July 1991: Emergency anti-terrorism legislation passed
1992: IG social service initiatives escalate following large earthquake
1993: Government tourism revenue drops to low of $1.1 billion annually
March 1993: Egyptian Security Forces escalate raids and arrest campaigns
310
groups in the early 1990s. The IG was high on the government’s list of targets, as it was
responsible for more than a thousand civilian and security personnel fatalities in the first
half of the 1990s.1180
The Egyptian Government had very little intelligence on the group in this period
as the security forces had not penetrated the group with human assets.1181 A good deal of
their information came fortuitously during police investigations and from house-to-house
searches and mass arrests.1182 Frustrated by their overall lack of progress, security forces
resorted to collective punishment, which included demolishing homes, holding relatives
of wanted terrorists in detention, holding onerous curfews, and rounding up suspects en
masse.1183 Some nighttime raids on suspected terrorist havens involved several hundred
security force personnel armed with heavy machine guns and rocket-propelled grenade
(RPG) launchers.1184 The security forces would then hold thousands of suspected
militants in extended detention without charges or trial.1185
In July 1991, Egypt passed anti-terrorism legislation that mandated life
imprisonment or death for those who committed terrorist offenses. Egypt would put to
death 90 individuals in this period—the largest number of executions for political crimes
1180 Jason Burke, Casting a Shadow of Terror, (I.B. Taurus: London, 2003), 139. 1181 Tal, Nachman. “Radical Islam in Egypt and Jordan.” (Sussex Academic Press: Brighton, 2005), 113. 1182 Tal, 113. 1183 Ibid, 115. 1184 Chris Hedges, “Egypt’s War With Militants: Both Sides Harden Positions,” The New York Times, April 3, 1993. 1185 Montasser Al-Zayyat, The Road to Al-Qaeda: The Story of bin Ladin’s Right Hand Man, (Pluto Press: London, 2004), 95. / Murphy, Caryle. “Passion for Islam: Shaping the Modern Middle East: The Egyptian Experience.” (Scribner: New York, 2002), 76.
311
in the country’s modern history.1186 By mid-1993, thirty-one prisons in Egypt housed
more than 40,000 convicts and political prisoners, including tens of thousands of Islamist
activists with no connection to militant activities.1187 Judicial standards were not very
rigorous, so evidence against arrested individuals was frequently thin.1188
In March 1993, Egyptian security forces dramatically escalated their campaign
against the Islamist militants. A massive wave of raids and arrests resulted in the deaths
of 45 people and the arrest of all bearded youth in numerous Islamist neighborhoods.1189
In one incident, security forces are said to have lobbed tear gas into a mosque in the
southern Egyptian city of Aswan and then subsequently killed seven people and wounded
15 others.1190
Though the Egyptian Government launched social welfare programs to combat its
negative image, the Islamist welfare programs in Egypt were generally far superior in
their quality.1191 IG welfare programs were also more strategically targeted than the
Egyptian Government’s programs, so the group did not need to compete with the
Government on all social programming. Thus, the Egyptian Government fought an uphill
battle for hearts and minds.
The heavy-handed activities of the Egyptian security forces affected IG both
positively and negatively. On the one hand, IG would benefit from an increase in popular
1186 Murphy, 7. 1187 Tal, 116. / Burke, 139. 1188 Lawrence Wright, The Looming Tower: Al-Qaeda and the Road to 9/11, (Alfred Knopf: New York, 2006), 185. 1189 Weaver, Mary Anne. A Portrait of Egypt: A Journey Through the World of Miltant Islam. (Farrar, Straus and Giroux: New York, 1999), 115. 1190 Stanley Reed, “The Battle for Egypt,” Foreign Affairs, September/October 1993. 1191 Weaver, 147.
312
support without having to ‘campaign’ for it. The government’s tactics alienated most of
the Islamist population and some of the non-Islamist population as well. Thus, IG would
not have to expose itself with complex media campaigns in order to cash in on increased
support. On the other hand, the government’s aggressive policing practices would reduce
the amount of territory and neighborhoods IG could control.
Organizational Structure. IG’s organizational structure in the 1989 to 1993
period was relatively loose and decentralized. IG’s military branch was run collectively
by a widely scattered network of leaders, some of whom were serving sentences in
Egyptian prisons.1192 IG’s cells were spread across Egypt, and typically based
themselves out of local mosques. Mosques would provide a great cover for clandestine
meetings or the passage of general directions from national leaders to local cells—
government security forces would not be able to infiltrate every mosque in Cairo nor
could they arrest every charismatic sheik and preacher without a major public backlash.
At the top of IG’s organization was its spiritual leader, or emir. Sheik Omar Abdel
Rahman, also known as the Blind Sheik, served as IG’s spiritual and inspirational leader
for a large part of its existence. Sheik Rahman played mostly a symbolic or spiritual role,
rather than an organizational role, in IG.1193
Below Sheik Rahman were the provincial emirs, who were also members of the
IG’s consultative body known as the Majlis al-Shura. Among other responsibilities, the
1192 Murphy, 77. 1193 Al-Hadlag, Abdulrahman. “Repression and Peoples’ Political Violence in Egypt: The Case of al-Jama’a al-Islamiyya.” Ph.D. diss., University of Idaho, 1994, 100.
313
Shura would elect IG’s emir.1194 Falling under the command of each provincial emir was
an emir designated for each town or village. Each of IG’s small group cells within these
towns and villages would also have an emir. The cell’s ‘emir’ would answer to a number
of superiors, though the lines of authority were poorly defined and directions
occasionally conflicted.1195 IG’s large numbers of militants, preachers, and leaders
created a sprawling organization.1196 This organizational structure made it difficult for
IG’s leaders to strictly control group activity, decentralizing decision making to the
village and town level to a great extent. Members of a cell in one Upper Egypt village or
Cairo slum would not know their colleagues in another village or slum.1197 IG’s
decentralized nature was occasionally evident in the aftermath of a terrorist attack, when
some elements of IG claimed responsibility for the attack while others denied
responsibility.1198
While IG cells had some freedom of action, they were not completely
autonomous from one another. IG’s top leaders issued general direction and religious
rulings to its cells, which cells obeyed for the most part, bound together by ideological
kinship.1199 Very few IG leaders were universally known, however, probably because
1194 Michael Collins Dunn, “Fundamentalism in Egypt,” Middle East Policy 2, no. 3 (1993): 75. 1195 Murphy, 65. 1196 Al-Zayyat, 71. 1197 G.G. LaBelle, “Abdel-Rahman’s Following in Egypt,” The Associated Press, July 18, 1993. 1198 Murphy, 88. 1199 G.G. LaBelle, “Abdel-Rahman’s Following in Egypt,” The Associated Press, July 18, 1993.
314
very few leaders had ultimate authority over the entire group or a full view of the
network.1200
There were several important IG leaders operating under Sheik Rahman.1201
Mustafa Hasan Hamza, thought to be the head military planner for IG, resided in Sudan
and Afghanistan. Talaat Fouad Qassam, the spokesperson for IG, resided in Denmark.
Rifai Ahmed Taha, resided in Afghanistan and helped direct attacks inside Egypt. Sawfat
Abdel-Ghani was convicted of ordering the 1992 assassination of human rights activist
Farag Foda from his prison cell. Mohammed Abu Halima served as an assistant to Sheik
Rahman inside of Egypt. Ali Abdel Rahman Salama was head of the IG military wing in
the Egyptian governates of Badari and Assuit. Talaat Yassin Mohammed Hammam led
IG members in Afghanistan and headed IG’s security branch. Ahmed Salam was a senior
operations officer for IG and Ahmed Sayid was the IG leader in Upper Egypt.
IG’s loose structure impacted the group both positively and negatively. On the
one hand, IG’s decentralized nature helped in recruiting members and cultivating new
leaders. Additionally, a decentralized cell network would make far-reaching government
infiltration of IG extremely time-consuming, as most cells would need to be penetrated
for the government to gain a full picture of the group’s activities. On the other hand,
decentralization allowed for strong local leaders to emerge and carry portions of the
group in directions ‘unapproved’ by national and regional leaders.1202 This potentially
1200 Weaver, 112. 1201 Charles Davidson, “Political Violence in Egypt: A Case Study of the Islamic Insurgency 1992-1997,” Ph.D. diss., Turfs University, 2005, 288. 1202 Stanley Reed, “The Battle for Egypt,” Foreign Affairs, September/October 1993.
315
would make it very difficult for IG leaders to impose standardized, high quality tradecraft
upon its many cells.
Resources. IG had significant resources at its disposal in this first period. While
the IG did not control large swathes of territory, the group did control some areas and
fielded a large number of militants and supporters.
IG’s resources were reflected in its campaign to fight back against the Egyptian
Government. In addition to IG’s anti-foreigner and anti-Christian agenda, Egypt’s
tourism industry was one of the IG’s most important targets. Tourism was the
government’s single largest source of foreign currency—$3.3 billion annually—and IG
believed its could turn the population against the government if Egypt’s tourism industry
were to falter.1203 IG’s attacks against foreign tourists and security personnel caused
massive panic. Government income from tourism dropped to $1.5 billion by 1993.1204
Attacks on policemen grew bolder across this time period, including daylight ambushes
against senior police security officials and their bodyguards.1205
IG’s manpower also grew in this period. At its peak, IG’s network of
underground militants reached approximately 3,000 men, while its network of supporters
and sympathizers was estimated to be between 10,000 and 100,000 people.1206 By 1993,
IG was thought to have a presence everywhere in Egypt, with a particularly strong
presence in Cairo and the southern portion of the country.1207 Many of IG’s members and
1203 Wright, 184. / Murphy, 81 1204 Murphy, 82. 1205 Ibid, 82. 1206 Ibid, 82. 1207 Ibid, 65.
316
sympathizers were poor, young and unemployed, though not necessarily uneducated.1208
Some of these individuals were recruited into the organization through a network of low-
cost health clinics, inexpensive schools, and stores providing jobs.1209
Some of IG’s operatives had valuable jihad experience in Afghanistan, which
increased their skill in guerrilla conflict. When veterans from the Afghan jihad returned
to continued their armed struggle in Egypt the Egyptian Government was taken off
guard.1210
IG’s targets were diverse, ranging from Nobel Laureate Naguib Mahfouz to street
police officers.1211 IG concentrates some of its attacks on areas where security forces had
been rough with IG members.1212 One of the group’s most daring initial attacks was an
attempted assassination against the Interior Minister Zaki Badr, who IG believed was
responsible for the intensification of police attacks on its operatives.1213 Security force
fatalities increased dramatically in the early 1990’s from 14 in 1991, to 23 in 1992, to 120
in 1993.1214
The group also aggressively targeted tourists and Westerners. Civilian fatalities
also increased dramatically from 16 in 1991, to 39 in 1992, to 111 in 1993. IG fatalities
kept pace, with 4 in 1991, 32 in 1992, and 101 in 1993.1215
1208 Jane’s Insurgency and Terrorism Database, “El Gemaa el-Islamiyya,” Accessed on 02/15/2007. 1209 Nejla Sammakia, “Islamic Fundamentalists Gain Strength in Egypt,” July 18, 1992. 1210 Murphy, 85. / Tal, 28. 1211 Wright, 184. 1212 Murphy, 77. 1213 Ibid, 78. 1214 Tal, 154. 1215 Tal, 154.
317
IG probably subsisted on a modest financial income in addition to support
provided by foreign state sponsors. IG is alleged to have collected ‘Islamic’ taxes in
Coptic Christian neighborhoods where inhabitants were encouraged to convert to Islam
or continue paying rents.1216 The Government of Sudan, Egypt’s southern neighbor,
provided IG activists with housing, documentation, training and safe haven.1217 This safe
haven allowed IG to gather up and smuggle weapons into Egypt to supply its operatives.
Sudan’s intelligence service provided further support to IG operatives, who were able to
smuggle explosives along ancient and unguarded caravan trials across the Sudanese-
Egyptian border.1218
One of IG’s most important resources in this period was its access to a large pool
of recruits. The large number of recruits allowed IG to maintain a force of operatives that
could overwhelm Egypt’s security forces, numbering far beyond what the Egyptian
Government could monitor closely. The large number, however, made it difficult for IG
to train and equip its operatives to the highest standards. The result was that the average
IG member would be more vulnerable to becoming a government informant—probably a
price IG was willing to pay for the volume of operatives it could throw against the
government.
IG’s decentralized structure also contributed to its large number of operatives,
with local branches springing up more readily and taking on recruits without waiting for
‘approval’ from a central IG authority.
1216 Ibid, 114. 1217 Ibid, 29. 1218 Wright, 185.
318
Popular Support. IG had high popular support in the 1989 to 1993 period. IG
dominated the Islamic activist scene on university campuses, lead by its spiritual guide
Sheik Rahman.1219 IG had a solid following in the towns of Upper and Middle Egypt,
though it shared equal popularity with another underground movement, Egyptian Islamic
Jihad (EIJ), in many neighborhoods of Cairo, Alexandria, Islamiya and Port Said.1220 In
contrast to EIJ, IG believed in displaying a public face, having a visible presence in the
community and taking responsibility for its actions.1221 Undoubtedly, this gave IG an
edge in the battle for popular support. IG’s core sympathizers were young men (typically
under the age of 30) with rural or small town backgrounds from the middle or lower-
middle class, with some university education.1222 IG also enjoyed wide spread support
among Egypt’s rural populations and among rural migrants in metropolitan locations.
Not surprisingly, IG flourished in areas where the Egyptian Government failed to
alleviate economic depression and high unemployment—which accounted for a
substantial portion of Upper Egypt.1223 IG enjoyed a boost of support, particularly among
Egyptian youth, when it initiated militant operations against the government.1224 The
government’s widespread crackdown on the Islamic community in the wake of increased
Islamic militancy in Egypt further strengthened IG’s standing in the community.1225 IG
also mounted publicity campaigns that highlighted the government’s use of corruption,
1219 Weaver, 29. 1220 Ibid, 88. 1221 Ibid, 68. 1222 Gilles Kepel, “Jihad: The Trail of Political Islam,” (I.B. Tauris: New York, 2006), 285. / Davidson, 277. 1223 Ibid, 28. 1224 Al-Zayyat, 71. 1225 Weaver, 147.
319
lying and torture to achieve its goals.1226 IG had some interaction with Western media
organizations in Cairo, releasing statements to reporters following a militant attack or
unpopular government action.1227
Islamic groups in Egypt often responded to the community’s needs more rapidly
than the Egyptian Government. In the aftermath of an earthquake in 1992, Islamic
groups rushed in to provide relief while the government moved much slower.1228 In the
Cairo slum of Imbada, home to 1.2 million squatters without access to basic public
services, IG opened mosques and schools and medical clinics.1229 The IG leader in
Imbada, Sheik Gaber Mohamed Ali, was recognized in the community for ridding the
slum of thieves and thugs. Worried that IG was beginning to gain control of Imbada, the
Egyptian Government conducted a weeklong security sweep where it arrested 650
suspected radicals.1230 Predictably, the community of Imbada became even more hostile
to the Egyptian Government and more supportive of IG. Despite these gains, IG
experienced occasional setbacks to its popularity in its slum territories. Girls and women
were subject to harassment if they moved about without proper Islamic head coverings
and Christian residents were threatened and forced to pay taxes to IG.1231
1226 Murphy, 85. / Nejla Sammakia, “Islamic Fundamentalists Gain Strength in Egypt,” July 18, 1992. 1227 Murphy, 83. 1228 Weaver, 249. 1229 Khaled Dawoud, “The Battle for the Mosque: Government vs. Extremists,” The Associated Press, December 24, 1993. 1230 Dalia Baligh, “Crackdown on Extremists Winds Down in Cairo Neighborhood,” The Associated Press, December 15, 1992. 1231 Weaver, 147.
320
IG’s popular support in the 1989 to 1993 period benefited the group immensely.
Popular backing in the slums of Cairo provided IG with small, but critical, pockets of
controlled territory. IG took a ‘hands-on’ approach to increasing its popularity,
establishing mosques and provided public services. The group’s decision not to rely on
media-based publicity campaigns provided the group with some counterintelligence
cover. IG’s simple Islamic values message, coupled with the government’s inept
handling of Islamic resurgence in Egypt, allowed the group to maintain its popularity
without exposing details of its leaders, organization and plans.
Intelligence. The quality of IG’s intelligence collection in this period is difficult
to determine. By analyzing the quality of its attacks, it is possible to draw some limited
conclusions about what intelligence would have been required to make such an attack.
IG had many successful and near-successful assassination attacks against ‘hard’
targets, which took numerous security precautions. IG killed Egypt’s parliamentary
speaker as well as numerous high-level security force leaders—targets that would likely
have had a cadre of well-trained security guards.1232 IG also attempted but failed to
assassinate several hard targets. The group made three attempts on the Egyptian Minister
of Information, two attempts on the Ministers of the Interior, one attempt on Minister of
Foreign Affairs and two attempts on the life of President Hosni Mubarak.1233 Targets of
this caliber would require a measure of relatively sophisticated surveillance methods.
Each of these targets would have had armed escorts that would likely employ
countersurveillance and counterattack procedures.
1232 Tal, 95. / Murphy, 82. 1233 Ibid, 28.
321
A few of IG’s assassination targets held security positions that would have been
unknown to the general public. This suggests that IG was using a penetration of the
security forces to identify these individuals. For example, on September 25, 1993, IG
militants gunned down Abd al-Halim, a member of a secret task force monitoring Islamic
militants, outside his house. A few days later IG assassinated a prison doctor they
accused of facilitating torture inside one of the security force’s covert prisons.1234
Counterintelligence. IG’s counterintelligence procedures in this period were
relatively basic, but sufficient to keep the group’s key leaders and large operational plans
secret.
IG’s internal security group was one of group’s more counterintelligence savvy
branches. The security branch was led by Talaat Yassin Hammam, known as the ‘Ghost’
to police forces due the difficulty they had in locating and capturing him.1235 Hammam’s
branch was responsible for special operations and counterespionage as well as physical
security for the group’s public meetings, seminars and demonstrations.1236 Though
Hammam’s branch was mostly compartmented from IG’s overt branches, Hammam’s
men would wear badges and provide crowd control at public meetings.1237 This practice
was a significant counterintelligence oversight for Hammam. This would have afforded a
watchful police service a chance to identify individuals with access to IG’s most covert
1234 “Jemmah Islamiya reported to Have Killed Policeman in Asyut,” AFP, September 25, 1993. 1235 Murphy, 77. 1236 Ibid, 74. 1237 Ibid.
322
operatives simply by taking note of which IG members wore this special badge at public
meetings.
Hammam exercised a great deal of personal security. He rarely met with anyone
in IG, including his own security branch personnel.1238 He never appeared in public,
unlike many other IG leaders. Many of his operatives maintained a high-level of
personal security as well. To avoid police scrutiny they held regular jobs, shaved their
beards and did not frequent IG mosques.1239 The importance of maintaining a low profile
was reinforced for IG operatives when the group’s spokesperson was gunned down by
undercover security forces in broad daylight on a Cairo street.1240
Senior IG’s operatives allegedly had instructions to commit suicide if they were
caught and detained by security forces to ensure that no information would leak out
during the brutal interrogation session.1241 On one occasion, an IG operative fulfilled this
command by jumping out the fifth-floor window of the police headquarters in Aswan
during an interrogation.1242
Some of IG’s operatives were not as well trained. One IG operative recruited in a
hasty manner completed an attack against a German tour bus and was quickly hunted
1238 Ibid. 1239 Ibid, 77. 1240 Ibid, 79. 1241 “Egypt’s New Security Strategy: No Dialogue, No Retreat in All-Out War,” Mideast Mirror, April 22, 1993. 1242 Ibid.
323
down by local police forces.1243 One of the men involved in the attack on Farag Foda
was captured and gave police details about the operation.1244
IG probably relied to some extent on tribal, kinship and friendship ties to weed
out potential informants and planted government agents.1245 When IG discovered a
police informant in its ranks, the informant would be killed.
IG also had a very public side to its activities, including its well-received social
services. Compared to Ayman Zawahiri’s clandestine EIJ operatives, rank-and-file IG
militants were probably easy for the Egyptian Government to identify.1246 The sheer
number of IG activists, however, would make monitoring each militant impractical—in
contrast, EIJ members were probably hard to find but easy to monitor due to the relative
small size of the group.
IG popular support helped the group to gain counterintelligence support from the
local population. IG’s political wing employed personnel that acted as community
liaison officers. These IG members would work with the local population to facilitate IG
communications, provide hospitality to IG couriers, and arrange hiding places for group
members on the run from the police.1247 IG political wing members would also select IG
recruits from the local population, which almost certainly involved working with locals to
weed out recruits with potential counterintelligence concerns.
1243 Murphy, 81. 1244 Tal, 97. 1245 Marc Sageman, Understanding Terror Networks, (University of Pennsylvania Press: Philadelphia, 2004), 147. 1246 Weaver, 88. 1247 Arbuckle, Tammy. “Egypt’s Catch-22.” Jane’s International Defense Review, 1993, 26.
324
IG’s communications with media organizations also exposed the group on a
regular basis. The group contacted numerous international media organizations in Cairo,
both by telephone and fax, to issue threats and claim responsibility for attacks against
tourists and security forces. In one instance, a key IG leader personally contacted foreign
journalists to claim that his fighters had carried out a recent attack.1248
In another instance, IG operatives conducted an interview a handful of Western
and Egyptian journalists at an IG safe house used clandestine operatives. They
compounded their mistake by using their real names in the interview.1249 Though these
operatives were emboldened by the fact that were inside their controlled territory in
Imbada, this still reflects fairly mediocre security tradecraft.
Overall, IG’s relatively basic application of counterintelligence methods in this
period reflected the fact that IG was not able to impose a strict standard of
counterintelligence awareness among its operatives. While top-level operatives did
employ strict security procedures, these habits did not filter down to lower levels. IG’s
large number of operatives, its quick recruiting cycle, and its relatively loose
organizational structure provides some explanation for this deficit.
IG was able to partially compartment its public branches from its clandestine
branches. Though there was some crossover between the two branches, the group
seemed to keep these functions separate and therefore avoided getting large numbers of
its covert militants arrested in this period. Interestingly, this strategy proved doubly
effective as the government, in its frustration to locate true IG operatives among a mass
1248 Tal, 95. 1249 Nejla Sammakia, “Islamic Fundamentalists Gain Strength in Egypt,” July 18, 1992.
325
of supporters and Islamic bystanders, resorted to mass arrests, which further drove the
population into the arms of IG.
Summary. In the 1989 to 1993 period, IG had a loose organizational structure, a
relatively incapable adversary, access to controlled territory, a relative abundance of
popular support and financial resources. IG’s struggle to standardize tradecraft supports
hypothesis one. The benefits and drawbacks of popular support and controlled territory
also appear to hold true for IG in this period. IG’s pockets of controlled territory
provided some guarantee that the Egyptian government would have difficulty gaining
insight into IG’s activities in these areas. IG’s ‘social services’ focused public support
campaigns, coupled with the Egyptian Government’s inept counterterrorism strategies,
added an interesting wrinkle to the popular support landscape—IG was able to gain
support without having to expose itself to the general population too extensively in the
media.
Islamic Group Timeline: 1994 - 1998
April 1994: Government passes emergency act
1994: Egyptian Security Forces kill key leader Hammam
1995: Government disrupts attacks on Cairo and the Delta areas
1996: Moderate IG leaders call for a general cease-fire
July 1997: Cease-fire negotiated with large elements of IG
November 1997: Luxor massacre perpetrated by hardliner IG elements
326
Islamic Group 1994 - 1998
Adversary Counterterrorism Capability. The Egyptian Government’s
counterterrorism capabilities increased dramatically in the 1994 to 1998 period. The
Egyptian Government improved its strategy in six key ways. First, the government
succeeded in recruiting IG members to infiltrate the group and provide intelligence.
Security forces began to recruit networks of informants and agents living among IG
members in their communities.1250 These informants provided vital information to the
security forces on the local activities of many IG cells. In 1995, security forces were able
to raid an IG cell safe house in Zawya Al Hamra and kill seven militants as a result of an
informant’s tip-off.1251 Based on information received from terrorist group penetrations,
security forces were able to thwart planned terrorist operations in Cairo and the Delta
areas in 1995.1252 Information gleaned from interrogations of captured IG members
would also prove critical in the human intelligence effort.
Second, the government created a centralized database to track terrorist groups,
their members and their activities.1253 This contributed to the government’s ability to
track and kill terrorists—357 for 1994 -1995, versus just 150 for 1992 - 1993.1254
1250 Tal, 119. / Youssef M. Ibrahim, “Egyptian Police, Sweep, Seize Suspects in Killing of Greeks,” The New York Times, April 20, 1996. 1251 Murphy, 92. 1252 Tal, 124. / Hassan Mekki, “Security forces kill top militant in new blow to fundamentalists,” Agence France Presse, November 17, 1994. 1253 Tal, 124. 1254 Ibid, 154.
327
Third, security force members received more extensive training, raising their level
of professionalism. This led to more effective policing of borders, particular the border
with Sudan, and ultimately to a reduction of weapons smuggled into Egypt.1255
Fourth, the government targeted high-level IG members for assassination and
capture and focused less attention on detaining and killing middle-level group members.
Security forces were successful in this effort, killing more high-level commanders than
they had in previous years.1256 The government was able to kill senior leader Talaat
Yassin Hammam and his replacement, Ahmed Hassan Abdel Galil in 1994.1257
Fifth, the government began to study IG’s international infrastructure and worked
to exploit the vulnerabilities of its transnational support networks.1258 Though IG’s
international infrastructure was not extensive, it included cells of terrorist operatives in
several European, Middle Eastern and South Asia countries. In addition, some of IG’s
leaders and fundraising elements were based outside of Egypt. Egypt’s ability to work
with foreign governments to facilitate the monitoring, arrest and extradition of IG
elements in those countries was an important component of this strategy.1259 The
government worked more closely with Arab governments in the region and Pakistan, in
particular, to shut down IG training camps and track down IG members operating
internationally.1260 Importantly, as the Egyptian Government operated more effectively
against IG within Egypt, IG members began to migrate increasingly to bases outside of
1255 Ibid, 149. 1256 Ibid. 1257 Ibid, 121. / Murphy, 93. 1258 Tal, 119. 1259 Ibid, 120. 1260 Ibid, 149. / Murphy, 86.
328
Egypt. This rendered the Egyptian Government’s ability to combat IG outside of Egypt
progressively more important.
Sixth, the government passed emergency anti-terrorism legislation that broadened
the counterterrorism powers of the security forces under a more legitimate, publicly
supported banner. The Egyptian parliament ratified the three-year extension of the ‘State
of Emergency Act’ on April 11, 1994. In addition, the penalties for committing a
terrorist act were made harsher and the definition of terrorism was broadened to include
“obstructing the work of the authorities.”1261
Though the Emergency Act had been effective since the assassination of Egyptian
President Anwar Sadat in 1981, the extension and other acts of anti-terrorism legislation
gave Egyptian security forces renewed cover for moving more aggressively against
terrorist elements.1262 Police forces were given the authority to open fire and assassinate
terrorist group leaders in broad daylight if they felt it was warranted.1263 Legislative
changes were accompanied by government-sponsored media campaigns aimed at
reducing IG’s appeal by publicizing particularly shocking terrorist acts.1264
By 1997, the Egyptian Government had so battered IG that large elements of the
group were ready to negotiate a cease-fire.1265 In July 1997, the Islamist lawyer
Montassir al-Zayyat had stuck a deal between IG and Egyptian Government, known as
1261 Murphy, 85. 1262 Wright, 215. 1263 2RAD-2004-600457. 1264 Tal, 133. 1265 While the Muslim Brotherhood had been co-opted political by the Egyptian Government to a limited extent, it is unclear what insight the Government gained into IG activities by way of potential ‘liaison’ contact with Muslim Brotherhood elements.
329
the nonviolence initiative.1266 In March 1999, IG’s exiled leadership ratified the group’s
decision to cease IG operations.1267
Though the Egyptian Government made huge strides in its counterterrorism
policy in this period, it also continued many ineffective and counterproductive practices.
Among these were the implementation of mass curfews, arrests and searches, the
mistreatment of civilians coming forward with information on terrorist activities, the
consistent overcrowding of prisons, and the use of collective punishments for entire
neighborhoods or families associated with militants.1268 While the Egyptian Government
probably deterred some IG activities with its security crackdowns, brutal police tactics
frequently backfired for the Government.1269 Whether security crackdowns provided a
net loss or net gain for Egypt is difficult to judge.
Overall, however, Egypt’s dramatic turn around in counterterrorism tactics paid
off remarkably well. The security forces less frequent use of collective punishments
coupled with a more legitimate legal platform almost certainly generated more public
support for the government campaign. Even more importantly, the government’s ability
to penetrate IG cells would lead a steady dismantling of the group. With IG leaders
increasingly dead or in prison, the group was forced to cave into the government’s
demands.
1266 Wright, 40. 1267 Mideast Mirror, “Cairo Frees 1,200 Gama’a Members Following Cessation of Violence,” vol. 13, no. 79. 1268 Tal, 150. 1269 Sarah Gauch, “Egypt Uses Fear to Fight Islamic Extremists,” Christian Science Monitor, April 3, 1995.
330
Organizational Structure. IG’s organizational structure in the 1994 to 1998
period remained relatively decentralized. A collection of influential leaders continued to
roughly direct the group’s actions, though increasingly these leaders would do this from
their prison cells.
A number of crucial field commanders, both in Egypt and overseas, took these
general directions from the most senior leaders and tailored their groups’ operations to
satisfy these strategic plans. An important overseas operative, Mustafa Hamza, trained
and directed a cell of militants in Ethiopia to assassinate Egyptian President Hosni
Mubarak.1270 Hamza, along with Afghanistan-based IG leader Ahmed Taha, planned and
directed a cell of militants to execute the Luxor Massacre in November 1997—a brutal
attack that left over 60 tourists dead and repulsed most Egyptians.1271 Talal Hammam
directed numerous cells in Egypt and once the security forces killed him, terrorist
activities dropped sharply.1272
The growing divisions in IG’s leadership created a more decentralized overall
organization. Ironically, the growing divisions may have also produced a collection of
more centralized sub-organizations. Divisions in the group formed between hardliners
and moderates, as well as between the internal Egyptian leaders and the external leaders.
IG’s many external leaders, known as the Diaspora Council, operated from Europe,
Afghanistan and North Africa and tended to support a hardliner approach until they
ratified the nonviolence initiative in March 1999. Key personalities on the Council were
1270 Tal, 110. 1271 Wright, 257. 1272 Murphy, 96.
331
Sheikh Rahman, Hamza, Mohammad Islambouli, Talat Qassem, and Rafai Taha.1273
Unhappy about the direction of the group, divided leaders probably attempted to more
forcefully shape behavior within their respective emerging divisions—whether they were
successful in this endeavor is not evident from the available historical record.
While the hardliners continued to plan audacious attacks against Egyptian
interests, the moderates realized that armed struggle would not achieve the group’s goals.
Sheikh Rahman—among the moderate members of the Diaspora Council—issued
decrees and direction to IG members from a prison in the United States. Prominent
moderate IG leader Khalid Ibrahim called for a general ceasefire in 1996, and many more
IG leaders echoed the call in July 1997.1274 Many of these moderate leaders, who tended
to be older than the hardliners, were languishing in Egyptian prisons when they called
from the ceasefire.
The Luxor Massacre further shattered the group, driving moderates to bend even
further to government demands. Taha, thought to have ordered the Luxor attack to
scuttle the ceasefire movement, was forced to resign from the IG council.1275
Interestingly, one IG source issued a claim of responsibility for the Luxor attack, which
was quickly answered with a counterclaim from IG’s ‘official’ spokesperson that rogue
IG members had perpetrated the attack.1276
1273 Tal, 29. 1274 Al-Zayyat, 70. 1275 Ibid, 30. 1276 Agence French Presse, “Most Jamaa leaders favor end to all attacks: lawyer,” December 11, 1997.
332
The Egyptian Government probably did not succeed in gaining a penetration of
IG’s leadership in Egypt or its Diaspora Council, as evidenced by the complete surprise
of the Luxor attack. However, the security forces were able to infiltrate a sufficient
number of lower level cells to disrupt many plots and capture many important leaders.
Resources. IG maintained its access to resources in the 1994 to 1998 period. IG’s
ability to carry out numerous terrorist operations was a testament to their access to
recruits, money and assistance from state sponsors. IG killed over 550 civilians and
security personnel between 1994 and 1998.1277 IG also achieved its goal of destroying
Egypt’s tourism industry—five star hotels were operating a 5 to 10 percent capacity,
cancelled reservations totaled $1 billion, and tourism companies had to reduce employee
salaries by 50 percent.1278
IG would get some of its money from government-sponsored charities in Saudi
Arabia and wealthy Saudi businessmen.1279 Other funds would come from membership
dues, contributions from Egyptians living overseas and donations from Islamic charities
and foundations throughout the world.1280 According to various trial transcripts, IG was
alleged to have received some of its money from Iran. 1281 IG would also receive
logistical support from the Sudanese government. The Sudanese issued diplomatic
1277 Tal, 154. 1278 Weaver, 267. / Tal, 99. 1279 Robert Fisk, “Might of the Sword Menaces Christians,” The Independent, February 9, 1995. 1280 Murphy, 87. 1281 Tal, 88.
333
passports to several IG cell members after they attempted to assassinate President
Mubarak in Ethiopia.1282
Many IG members remained well trained in this period, benefiting from years of
guerrilla experience in the Afghan War.1283 The group’s access to recruits and fighters
continued, though the government had arrested and incarcerated an estimated 20,000
militants by 1997.1284
The group’s access to controlled territory also continued. IG would use Sudanese
territory to train and stage unmolested by Egyptian security forces.1285 Though Sudanese
support to IG may have been declining by 1996, Sudan almost certainly remained a key
safe haven in this time period.1286 Though the Egyptian Government began to push IG
members from its traditional strongholds in Upper Egypt, the group would retain its core
territories in Assiut and Minya.1287
IG’s support from foreign sponsors probably became increasingly important as
the group was driven from its traditional strongholds within Egypt. This also became one
of IG’s liabilities, as its dependence on the foreign sponsors backfired once the Egyptian
Government began to track and eliminate its foreign connections.
1282 Sageman, 42. 1283 Murphy, 92. 1284 Mark Huband, “Luxor Masterminds in Afghanistan Exile,” The Financial Times of London, November 20, 1997. 1285 G.G. LaBelle, “Charges of Terrorism, Claims of Democracy Mix Blur of Sudan,” The Associated Press, March 28, 1996. 1286 James Adams, “Americans Move to Destabilise Sudanese regime,” Sunday Times November 17, 1996. 1287 Hassan Mekki, “Security forces kill top militant in new blow to fundamentalists,” Agence France Presse, November 17, 1994.
334
Popular Support. The Egyptian population’s precipitous decline in popular
support for IG was perhaps the most dramatic change for the group in the 1994 to 1998
period. IG had calculated correctly that attacking the tourism industry would hobble the
Egyptian Government’s economic base. IG hadn’t accounted for the fact that it would
also destroy the livelihoods of millions of regular Egyptians, and turn them against the
group. Directly or indirectly, more than 10 million Egyptians nationwide had been
involved in the tourism trade and where thus negatively affected by the drop in
tourism.1288 Moreover, the bulk of Egyptians did not support widespread violence against
foreigners and venerated Egyptian intellectuals like Mahfouz—this targeting strategy
almost certainly backfired on IG as well.
Without the support of the population, IG had to retreat even further into its inner
strongholds in Upper Egypt. IG’s internal leaders, many of whom remained in prison,
recognized that their defeat was inevitable and moved to endorse a ceasefire.
IG’s strategic miscalculation highlighted an interesting dynamic between popular
support and effective terrorist operations. IG had to find a plan of attack that struck at its
enemy, the Egyptian Government, without causing direct collateral damage to its base of
support. The group’s attacks on Egyptian security forces seemed to fulfill this
objective—security forces overreacted and imposed unpopular collective punishments on
the population—leaving IG only indirectly responsible for the collateral damage. IG’s
attacks on tourists lead directly to tourists canceling trips to Egypt and directly to a loss
of revenue. The lesson for terrorist groups is that populations will punish a group for
1288 Weaver, 267.
335
causing direct collateral damage to the population but may be less likely to punish a
group for indirectly inviting such collateral damage. The lesson for governments is that
populations should always be reminded of the direct role the local terrorist group plays in
bringing collateral damage upon that population.
Intelligence. Determining IG’s intelligence capabilities in this period is difficult,
but it is possible to reach some conclusions about these capabilities by looking closely at
the group’s activities.
IG monitored and assassinated several hard targets, which indicates that the group
had some advanced surveillance capabilities. For example, IG assassinated the deputy
chief of an elite police force, which was the Egyptian equivalent of the Federal Bureau of
Investigations. More impressively, the murdered deputy had been using an unmarked car
and had implemented countersurveillance measures. It is possible that IG’s operations
against this deputy and his three aides in previous incidents could have been aided by an
IG penetration of the elite police force.1289 In another example, it is widely believed that
the 1994 assassination of Major General Rauf Khayrat, a ranking veteran of the security
services, would have required information accessible only to high-ranking security
officers.1290 In either case, advanced surveillance and human penetrations suggest a fairly
sophisticated intelligence collection capability. IG also assassinated a number of police
generals and high-ranking judges, who they blamed for the conviction of IG members.
1289 Murphy, 91. 1290 Joseph Kechichian and Jeanne Nazimek, “Challenges to the Military in Egypt,” Middle East Policy 5, no. 3 (September 1997): 128.
336
Though IG failed to assassinate President Mubarak, they nearly succeeded during
a Presidential trip to Ethiopia. The assassination unit had trained for and rehearsed their
attack in Khartoum, which demonstrates an additional layer of sophistication.1291
Many of these incidents suggest that IG had some insiders feeding them
information about the locations of their targets, at the very least. However, it is likely
that most of these penetrations were not high-level, but rather somewhere fairly low in
the security bureaucracy.
Counterintelligence. IG began to suffer from numerous counterintelligence lapses
in this period, some of which stemmed from the government’s increased capabilities and
some of which stemmed from the group’s hemorrhaging popular support.
Prominent IG commander Talat Hammam faced a number of counterintelligence
failures just before he was captured by security forces. On February 16, 1994,
Hammam’s picture ran on the front page of Al Akbar newspaper with the offer of a
reward.1292 Not only was Hammam’s picture soon plastered on every coffee shop and
sidewalk kiosk, but the fact that the security forces had collected a ‘confirmed’ picture of
Hammam suggested a major security leak in IG. Hammam soon sent out a message over
public radio canceling all IG meetings and movements for a week. The fact that
Hammam did not have any other way to securely transmit this message to the rest of his
IG compatriots suggests that IG counterintelligence procedures were slipping as times
became desperate.
1291 Tal, 110. 1292 Murphy, 90.
337
With his group facing increasing pressure, Hammam was forced to meet face to
face with front line operatives rather than to send intermediaries. Police forces began to
draw a progressively tighter circle around Hammam’s activities until they finally
cornered him in his apartment in the Cairo neighborhood of Hada’ak Al Kubbah.1293 One
police official claimed that they found Hammam by monitoring militants overseas who
they suspected would try to contact Hammam in Cairo.1294 The government also alleged
that they were led to Hammam by a penetration of this network.1295
Seizing Hammam in his operations center and residence caused extensive damage
to key IG networks. With documents recovered from Hammam’s center, police were
able to storm 36 other cells and arrest 120 of Hammam’s confederates.1296 Additionally,
the police found numerous forged identification papers and passports. This could have
allowed Egyptian police to target individuals with similar forged documents in
circulation for greater scrutiny.
Examination of Hammam’s center also revealed a number of the IG leader’s
personal counterintelligence strengths and vulnerabilities. First, Hammam lived with his
wife and two children, which could have imposed additional counterintelligence
weaknesses for Hammam as his wife would likely have been easier to track.1297 Second,
Hammam’s center was located only a short distance from the headquarters of Egypt’s
elite police forces—an audacious move that could have gotten Hammam wrapped up
1293 Ibid, 93. 1294 Ibid, 95. 1295 Ibid. 1296 Ibid, 94. 1297 Ibid, 95.
338
even sooner. To Hammam’s credit, he did not fit the profile of a typical slum-based IG
member. Instead, he lived a bourgeois lifestyle and drove a late-model red
Mistubishi.1298
Once captured, IG members most likely gave up more information about the
group to police interrogators. In the case of the attempted assassination of Mubarak, the
terrorists arrested following the attacks identified to the police the other militants
involved in the attack.1299
IG also had several counterintelligence successes in this period. The group
successfully stemmed the tide of police informants by monitoring and harassing
suspected informants in their neighborhoods. In the Upper Egypt slum of Mallawi, IG
detained and killed over 40 informants in only four months in 1995.1300 While the
amount of information available to the adversary was reduced substantially, that IG had
to fight a tide of informants may have been an indication that popular support was
slipping. IG’s international operations, including the assassination attempt on Mubarak,
also indicated a level of sophistication. For the assassination attempt, IG established an
operational infrastructure in Ethiopia that included safe houses, weapons, escape plans,
communications, and forged documents.1301
1298 Ibid. 1299 Tal, 110. 1300 Robert Fisk, “Terror Stalks Egypt’s Forgotten Towns,” The Independent, February 8, 1995. 1301 Tal, 110.
339
Overall, IG’s counterintelligence capabilities were in decline in this period. The
two most obvious sources of this decline were the group’s declining popular support and
the increased counterterrorism capabilities of the Egyptian security forces.
Declining popular support would allow police forces to develop a larger number
of informants within and around the group in its areas of operations and controlled
territories. IG’s initiative to stage its leadership and some operations outside of Egypt are
a testament to the fact the Egypt was becoming a hostile operating environment for the
group.
The government’s augmented counterterrorism capabilities turned the conflict
even more dramatically in the state’s favor. Adept monitoring of militants overseas and
exploitation of documents seized at crime scenes allowed the police to capitalize on IG’s
counterintelligence vulnerabilities.
Summary. In the 1994 to 1998 period, IG maintained a loose organizational
structure and an abundance of resources and controlled territory. However, IG faced a
much stronger adversary and a sharp reduction of popular support. Despite some
continued success, IG made a critical strategic miscalculation in this period. The group
wagered that their attack on the tourism industry would harm the government but would
not undercut their popular appeal in Egypt. However, as the tourism industry faltered,
occasionally on the heals of brutal civilian attacks, the public began to turn against IG.
The goodwill that seemed to insulate IG from penetrations in the first period faded away.
The government’s dramatic increase in counterterrorism capabilities compounded
IG’s problems. The government was very successful at rounding up key IG leaders and
340
operatives and keeping them in jail. As the number of key IG personnel in prison
increased, the group slowly realized that it was on the brink of failure. Ultimately, it is
difficult to judge whether the IG’s counterintelligence challenges are a result of the
fading popular support or the government’s increased capabilities—most likely the
challenges the group faced came as some combination of the these two major changes.
Hypotheses Revisited
Hypothesis 1(A): With a relatively tighter command and control structure IG will
have superior counterintelligence training and compartmentation. The IG case mostly
supports this hypothesis. IG’s loose organizational structure in the 1989 to 1993 period
prevented the group from imposing rigorous tradecraft upon its group members. The lack
of counterintelligence standards occasionally backfired for IG, as men who were captured
by the police quickly gave up important operational details. IG became more fragmented
in the 1994 to 1998 period, though each of the fragments may have become relatively
tighter than the previous whole.
Hypothesis 1(B): With a relatively tighter command and control structure IG will
be more vulnerable to its adversary’s efforts to develop high-level penetrations and
exploit the group’s standardized counterintelligence procedures. The IG mostly supports
this hypothesis. IG’s loose structure allowed for the emergence of strong local leaders,
which militated against the creation of an IG-wide, standardized tradecraft. This
prevented the Egyptian government from exploiting group-wide plans and procedures.
Functionally, this meant that the Egyptian would have had to penetrate a large percentage
of IG cells to understand and predict IG’s behavior and upcoming plots.
341
Hypothesis 2(A): With relatively greater popular support IG will have greater
counterintelligence support from the local population. The IG case also supports this
hypothesis. There is evidence that the local population provided counterintelligence
assistance to IG when the group enjoyed high levels of popular support. Support appears
to include identifying and vetting potential recruits, helping to secure courier-based
communications, and providing hiding places for IG members on the run from the police.
Hypothesis 2(B): With relatively greater popular support IG will be more likely to
expose itself in its efforts to maintain popular support. This hypothesis is partially
supported by the IG case. IG was very concerned about popular support and, in contrast
to groups like Egyptian Islamic Jihad, worked hard to cultivate a public side. IG
routinely reached out to local and international media outlets, telephoning and faxing
media offices and granting interviews with journalists. All of this behavior risked
exposing sensitive details about IG personnel and resources to the Egyptian Government.
In one instance, IG even held an interview in an operational safe house—a dangerous
move if the safe house were ever to be used again by undercover operatives. However,
IG was able to gain popular support in ways that provided much less exposure to the
media. First, IG relied on providing social services through local mosques, health clinics
and schools. This directly increased popular support while giving up few important
details about the group’s membership and resources. Of course, the leadership of the
mosques, health clinics and schools would have had some connection to more central IG
figures and, thus, would have been priority recruitment targets from the Egyptian
government. IG relied on the Egyptian Government’s heavy-handed missteps to gain
342
additional support—a windfall the group forfeited when they began to more brutally
attack civilians and tourism industry.
Hypothesis 3(A): With relatively more controlled territory IG will have superior
communications security, physical security and counterintelligence vetting. This
hypothesis seems mostly correct. IG clearly benefited from controlled territory in terms
of security. Egyptian security forces could not adequately police these areas and had to
rely on mass sweeps and raids when venturing into IG territories. Raids on this scale
may have been easy to predict and may have given key leaders and operatives a chance to
hide or escape police round-ups.
Hypothesis 3(B): With relatively more controlled territory IG will be more
vulnerable to its adversary’s efforts to track the group’s gross financial, logistical and
personnel movements. This hypothesis also seems mostly correct. IG’s controlled
territories gave security forces an area to target, and mass arrests almost certainly netted
some operatives and IG sympathizers. This would have provided Egyptian forces with
captured militants who would give up some useful information in the course of an
interrogation—on balance, however, it is difficult to assess whether the mass arrests
served as a net gain or net loss for the Egyptian government.
Hypothesis 4: IG will become increasing centralized and tightly
commanded over time in the face of external threats. The IG case provides tentative
support for this hypothesis. IG’s military wing, the branch of IG that had the greatest
exposure to hostile Egyptian security forces, was relatively tightly coupled and
centralized around Talat Hammam during both periods one and two. Overall, however,
343
the group became more fragmented over time as moderates, hardliners, internal and
foreign components each desired a preferred direction for the group. Leaders were faced
with an increasingly capable adversary and a need to reassess IG’s preferred targets—the
hardliners wanted to continue attacking tourists and civilians while the moderates
predicted that this strategy would ultimately lose popular backing. Despite this macro-
fragmentation, the organizational structure likely tightened up as each division began to
assert more control over their sub-group membership. Thus, there is a distinct possibility
that the government’s direct, growing challenge to IG caused the group to evolve into a
more fragmented but centralized structure. Unfortunately, evidence of organizational
tightening is not available from the historical record.
Control Variables: Alternative Explanations Review
As discussed earlier, the control variables did not remain perfectly constant in the
IG case study, opening up the possibility that the control variables account for some of
the change in the dependent variables. First, the Egyptian Government increased its
counterterrorism capabilities dramatically between the first and second periods. Thus,
any erosion in IG’s counterintelligence capabilities could result from this shift, rather
than shifts in organizational structure, popular support or controlled territory. First, IG’s
vulnerability to human penetrations increased from period one to period two. This
vulnerability appears to have resulted from the Egyptian Government’s increasing
counterterrorism capabilities rather than from changes in IG’s command structure.
Second, IG’s controlled territory vulnerabilities were almost certainly heightened by the
Egyptian Government’s ability to exploit them—however the Egyptian Government was
344
able to exploit these vulnerabilities in period one as well, when the government’s
counterterrorism capabilities were assessed as low.
The organizational learning hypothesis would predict that IG’s
counterintelligence capabilities should improve over time. The organizational learning
hypothesis cannot account for capabilities that decrease over time, as learning leads
almost exclusively to improvements. IG’s key counterintelligence capabilities mostly
decreased over time and therefore the organizational learning alternative hypothesis is
disconfirmed. Additionally, IG’s resources were constant over time and therefore
changes in the independent variables cannot be explained by a shift in resources.
Lessons from IG Case Study
The IG case study provides support for several hypotheses and provides insight
into potential interactions between the independent variables and between the intelligence
and counterintelligence variables.
First, the IG case demonstrates the interesting tension that arises between
maintaining controlled territory and popular support. In general, controlling territory
leads to increased popular support when the group provides public goods to, while
demanding little from, the population. When the group can offer social services to the
population, while doing very little ‘social policing’ (i.e. punishing people for not
adhering to the group’s particular, in some cases religious, social agenda), the population
will most likely be very supportive. This support can be further strengthened when
frustrated government forces make heavy-handed incursions into controlled territory,
further alienating the population to the government’s cause. IG’s ultimate failure to
345
terrorize the Egyptian Government without terrorizing its own population highlights the
difficulty groups face in pursuing a terrorist mission on home soil. Terrorist groups that
create wide separation between the territories in which they operate and the territories
they control and derive popular support will more easily avoid this predicament. Al
Qaeda, for example, largely avoided this problem in the 1990s by conducting terrorist
operations in areas far removed from its core territories in Afghanistan.
The case also highlights the challenges and tradeoffs governments face when
battling a group with controlled territory. On the one hand, government incursions into
controlled territory have the potential to backfire dramatically if the government’s
counterterrorism nets snare numerous innocent bystanders—a likely outcome in territory
with which security forces are not familiar. On the other hand, groups that controls
territory for long periods are likely to harbor numerous high value terrorist targets and
may have relaxed security practices as the territory is perceived as relatively
impenetrable. In such an instance, a government raid can yield a good deal of
intelligence from high value targets while alienating segments of the population inside
and outside of the controlled territory. Governments need to weigh these tradeoffs
carefully for each territory and its likely intelligence yield when planning mass arrests
and raids.
Third, the case highlights an interesting facet of the relationship between popular
support and the adversary’s counterterrorism capabilities. As the Egyptian Government
become more capable of protecting its forces against IG attacks, IG operatives were
forced to attack less protected targets—civilians, Coptic Christians and tourists. Whereas
346
attacks on government forces were more widely supported, attacks on tourists and
civilians were not as popular.
347
CHAPTER SIX: TERRORISM AND COUNTERINTELLIGENCE
The practice of counterintelligence, whether for terrorist groups or governments,
is a discipline of calculated tradeoffs. Like a game of chess, the majority of ‘moves’ in
the operational environment enhance some features of an organization’s
counterintelligence posture while weakening others—for example, advanced technologies
offer counterintelligence benefits but usher in new technical counterintelligence
vulnerabilities; an increased attack tempo wins more popular support for a terrorist group
but also increases the group’s operational profile; group record keeping enhances
counterintelligence trend analysis but also leaves a paper trail of the organization’s most
sensitive personnel and activities. The hypotheses explored in the case studies
underscore this fundamental feature of counterintelligence by demonstrating that terrorist
groups regularly grapple with the counterintelligence tradeoffs posed by their
organizational structure, popular support and controlled territory.
In this final chapter, data and insights from the case studies and the large data set
will be synthesized to provide the clearest possible judgment of the hypotheses and the
mechanisms driving the observed outcomes. First, the core hypotheses and control
variables will be reviewed along with the alternative hypotheses. Second, the chapter
outlines how the study’s findings advance several theoretical debates and, more broadly,
create new avenues for research in the field of terrorism and intelligence and
counterintelligence studies. Finally, the chapter contributes to the counterintelligence
policy debate by translating the lessons of this study into practical moves for improving
global counterterrorism efforts.
348
Reviewing the Hypotheses: Organizational Structure
Hypothesis 1(A): A terrorist group with a tight command and control structure,
relative to a group with a loose command structure, will have superior
counterintelligence training and compartmentation. The study strongly supports this
hypothesis. The large data set showed that tightly structured groups tend to have better
counterintelligence training. The case studies also support this hypothesis. The PIRA
case provides the best test of this hypothesis as its organizational structure rapidly
tightened in the mid 1970s while all other variables stayed constant. As the PIRA
tightened its structure it was able to more effectively compartment its operations and train
its members in counterinterrogation techniques. Fatah and BSO both had tight structures
and successfully trained their members in counterintelligence methods. From 1989 to
2001, al Qaeda had a relatively tight command structure and was able to train its
members in counterintelligence. When al Qaeda’s structure began to loosen after 2001,
the al Qaeda rank-and-file outside of Afghanistan had to rely on previous training, or in
some cases Internet-based training, to develop and sharpen their counterintelligence
practices—of course, some of the training deficits al Qaeda experienced after 2001
resulted from al Qaeda’s being physically cut off from their overseas operatives, rather
than from their loosening organizational structure. The Egyptian Islamic Group had a
loose structure its entire existence, which prevented the group from imposing rigorous
tradecraft on its group members and led to a variety of basic counterintelligence
vulnerabilities.
349
Hypothesis 1(B): A terrorist group with a tight command and control structure,
relative to a group with a loose command structure, will be more vulnerable to its
adversary’s efforts to develop high-level penetrations and exploit the group’s
standardized counterintelligence procedures. The study strongly supports this
hypothesis. The large data set showed that tightly structured groups tend to have
standardized counterintelligence procedures. The case studies also support this
hypothesis. For the PIRA, moving from a loose to a tight command structure increased
the risk of high-level penetrations. British infiltration of the PIRA security department in
the late 1970s provided British forces with a volume of information on the PIRA that
they could not have acquired with their best penetrations of the early 1970s. Fatah’s tight
structure permitted the use of standardized codes, which the Jordanians exploited to
monitor and capture Fatah operatives. In contrast, when al Qaeda was loosely structured
each of its cells was responsible for devising their own set of codes to communicate with
cell members. With cell-based code selection, the discovery of one cell’s codes would
not necessarily compromise another cell codes. When al Qaeda was tightly structured in
the 1990’s, however, al Qaeda turncoat al-Fadl was able to describe many details of the
group’s international organization to US authorities in 1996.
Hypothesis 4: Terrorist groups facing external threats will become increasing
centralized and tightly commanded over time. The study supports this hypothesis. The
large data set showed that many mature terrorist groups were centralized and tightly
commanded. Moreover, tightly commanded groups suffered fewer counterintelligence
vulnerabilities than loosely commanded groups, which were less likely to have
350
standardized counterintelligence training, strong communications security and strong
vetting procedures. The cases also mostly support this hypothesis. The PIRA leadership
recognized explicitly in multiple internal documents that British counterterrorism
capabilities had to be met with improved counterintelligence tradecraft. The PIRA
deemed it essential to its survival to become more effective in counter-interrogation
techniques, vetting new members, conducting investigations of suspected informants, and
lowering the operational profiles of members, all of which required tightening and
compartmenting its structure. If the PIRA had not adapted so effectively it probably
would have been incapacitated, if not completely eliminated, by the end of the 1970s. Al
Qaeda maintained a tight organizational structure until it was unable to do so following
the loss of its safehaven in 2001. Al Qaeda’s near complete loss of its communications
infrastructure in this period physically prevented the group from conveying commands
and receiving feedback from its international operatives in a manner reliable and timely
enough to retain tight command over the organization.
While the tight command structure appears to be favored by terrorist groups, it is
not without its flaws, as described above. Interestingly, a tight command may facilitate
catastrophic counterintelligence vulnerabilities, such as damaging, long-term penetrations
by the group’s adversary. However, because these catastrophic weaknesses are very
difficult to detect and slow to develop, terrorist groups may be very far down the road to
a tight structure before they become aware of such vulnerabilities. Tightening command
structure may also reflect the preference of terrorist group leaders to retain control over
their organization, despite the attending counterintelligence disadvantages, real and
351
perceived. Thus, tightening may not always be the most logical or efficient structure for
the group, but rather one that favors the group leader’s personal preferences.
Furthermore, as a group becomes tighter organizationally, it will be increasing easier for
a powerful central leader to nurture this trend and defeat calls for decentralization.
Causal Mechanisms. The case studies suggest several driving forces behind these
outcomes. First, loose organizations are less capable of monitoring and controlling, and
therefore training, its members. With little oversight, members of loose organizations
may be unwilling to implement good counterintelligence tradecraft. Good
counterintelligence is often inconvenient and laborious. Members must refrain from
many common conveniences and comforts that they’ve grown used to enjoying, such as
keeping in touch with family and friends. With little oversight, members of loose
organizations may also be incapable of implementing good counterintelligence tradecraft.
In addition, counterintelligence procedures are occasionally subtle or counterintuitive.
Members will likely understand that they are forbidden from providing information
directly to their adversary, but members may not be aware of the many indirect ways the
adversary collects information on their organization, such as through informants and
wiretapping.
The inability to strictly control group members also impairs organizational
compartmentation. A compartmented organization requires high levels of coordination
between organizational units to effectively prosecute its mission—compartmentation
without coordination and oversight results in organizational fragmentation and
disintegration.
352
Conversely, because members of loose organizations are less controllable they are
also less predictable to the adversary. There are fewer ‘signature’ styles of attacking,
organizing covert cells, reaching out the media, and communicating. Additionally, loose
organizations rarely assign individual members administratively responsible for
managing large portions of the organization, such as a payroll or security section. For the
adversary facing a tightly commanded organization, these administrative sections are a
prime target for high-level penetrations.
Organizational Structure and Counterintelligence. The structure of an
organization and its level of compartmentation deeply affect the organization’s
counterintelligence posture.
Tightly structured organizations have the important advantage of being more
capable of conducting superior training. While training can specifically augment
counterintelligence procedures, it can also instill a general sense of discipline in group
members. Before the PIRA began its standardized training, the British often referred to
PIRA sloppiness as the “Paddy Factor”, due directly to the general lack of operational
discipline. Tight organizations also enjoy superior strategic coordination, which is
critical to systematic analysis and dissemination of lessons learned. Al Qaeda kept
meticulous records of its members, which aided in identifying ideal candidates for
particular missions as well as internal counterintelligence threats. Black September
Organization was able to rapidly recover from an Israeli raid on its headquarters due to its
tight organizational structure, quickly replacing agents, changing codes and abandoning
missions in the planning stages across the world.
353
The most important weakness of tightly structured organizations is there
vulnerability to long-term penetrations. Like any tightly structured organization, tightly
structured terrorist groups promote low-level members to increasingly important
positions over the course of their career. The teenage courier and low-level ‘lookout’
eventually gets promoted to regional quartermaster and perhaps, one day, to senior
advisor to the head of the security department for the entire organization. Recruiting the
young, impressionable, and cash-strapped teenager and handling him until he becomes a
senior commander may prove easier than recruiting the hardened senior leader.
Additionally, senior leaders in tight organizations are typically left in positions of
influence until they retire. Therefore, once a senior leader is recruited, he is likely to
maintain his access to sensitive information for many years. This is exactly what
happened with the British recruited the high-ranking PIRA counterespionage officer
Freddie Scappaticci. Scappaticci became a key British informant as he had access to the
PIRA’s innermost secrets—upcoming missions, arms cache locations, travel and security
details, bombing and assassination targets, and which PIRA volunteers were suspected of
being informants. Scappaticci was able to protect himself from suspicion by rigging
counterespionage investigations and framing ‘innocent’ PIRA members. 1302 Loose
organizations are better at avoiding this problem because group members are not
necessarily promoted from local or regional cells to a centrally–managed or administrated
headquarters.
1302 Matthew Teague, “Double Blind: The Untold Story of How British Intelligence Infiltrated and Undermined the IRA,” The Atlantic Monthly, April 2006.
354
Standardization also has its benefits and drawbacks. Standardization allows a
group to establish uniform, high-quality training and operational procedures across the
organization. The organization can then approach the operational environment with some
assurance that each member is capable of performing certain activities, such as firing a
weapon or resisting interrogation. Standardization also makes an organization more
predictable and therefore easier to monitor and manipulate. Fatah’s use of standard codes
allowed the Jordanian government to manipulate the organization by mimicking their
communications. Standardization of special technology or training procedures also
increases the risk that these special technologies will be exposed to the adversary. For
example, one PIRA branch resisted sharing its radio-controlled bomb technology with the
rest of the PIRA for fear of having it captured and studied by the British—which is
exactly what happened when PIRA headquarters began to share the bomb technology
with other PIRA units.1303 Standardization also risks leaving signatures, footprints, and
patterns that the adversary can study and exploit over time. Al Qaeda established a
formal system of using guesthouses and specific vetting procedures to screen recruits
coming to al Qaeda camps. Standardized vetting would allow a clever adversary to
penetrate al Qaeda camps by studying and testing the vulnerabilities in the group’s
vetting procedures.
Compartmentation has its benefits and drawbacks as well. Compartmentation is
designed to keep most of the members of one cell from knowing the members of another
cell and dependent on top leadership for resources and direction. Compartmentation of
1303 Maloney, 160.
355
the PIRA made it difficult for a British interrogator to extract much information from a
captured PIRA member.1304 Compartmentation also makes counterintelligence
investigations easier. Restricting the flow of information makes the list of suspects with
access to the ‘compromised’ information small, giving a potential mole far less room to
maneuver. For the counterterrorism official, this is a critical point. Understanding if and
how a terrorist group is compartmented is important step in managing terrorist group
penetrations. For example, if a government acts on information provided to it by a
terrorist group member, such as conducting a raid or bombing a specific location, the
government needs to be sure that many individuals in the terrorist group had access to
this information or it will risk compromising its source. On the other hand, a government
may have the opportunity to create paranoia in a terrorist group if the true source of
actionable information is considered above reproach or believed not to have access to the
compromised information. Thus, the government may act on this information for the
purpose of causing the terrorist group to initiate an internal investigation that generates
confusion and mistrust in their ranks.
However, compartmentation is an ideal that is probably seldom achieved.
Particularly in organizations that recruit from particular families, ethnicities or
neighborhoods, many members will know many other members in distant compartmented
cells. For the PIRA, the British ‘supergrass’ informants made this point painfully
obvious when they gave evidence in court against former PIRA colleagues, despite
1304 Taylor (1997), 211.
356
extensive formal compartmentation within the PIRA.1305 Too much compartmentation
can also be harmful, if leaders are killed or captured and remaining members are not fully
briefed on the operational goals and plans. When a mixed Japanese-Palestinian BSO
group attempted to hijack a Japanese airliner in July 1973 the mission planner was killed
during the initial aircraft takeover. No other member of the hijacking team was fully
briefed on the mission, so the remaining terrorists had to abandon the operation.1306
Compartmentation, and secrecy more generally, can also hinder the development
of popular support. Organizational leaders and top commanders may opt for greater
secrecy to avoid assassination, but will also conversely lower their public profile.
Lowering senior leaders’ public profile can ultimately backfire if the popular support
base loses interest in an organization with no face or personality.
Reviewing the Hypotheses: Popular Support
Hypothesis 2(A): A terrorist group with popular support, relative to one without
popular support, will have greater counterintelligence support from the local population.
The study supports this hypothesis. The large data set showed that groups with high
popular support tend to have counterintelligence support from the local population. The
case studies also support this hypothesis. The PIRA received crucial counterintelligence
support from its Hen Patrols, who were members of the community that alerted
Republicans to incoming British patrols and raids. Fatah leaders could easily relocate
from apartment to apartment in Beirut when the group enjoying high popular support in
1305 Taylor (1997), 211. 1306 Dobson, 47.
357
the 1967 to 1984 period while the group was constantly ratted out in the West Bank and
Gaza in the low popular support era of 1964 to 1967. Before al Qaeda gained
international notoriety it sent core group members to do all of its intelligence collection
for the US Embassy attacks. After it gained popular support it was better able to exploit
local networks to gather intelligence. For the Islamic Group, local support included the
identification and vetting of potential recruits, aid in securing courier-based
communications, and the provision of hiding places for Islamic Group members on the
run from the police.
Hypothesis 2(B): A terrorist group with popular support, relative to one without
popular support, will be more likely to expose itself in its efforts to maintain popular
support. The study mildly supports this hypothesis. The large data set showed that
terrorist groups tended to compromise sensitive organizational details in their efforts to
gain popular support, regardless of whether they enjoyed popular support. The case
studies show, however, that having high popular support increases the likelihood and
depth of exposure to the media.
The PIRA routinely exposed its personnel and plans at PIRA marches, rallies and
pubs, despite non-fraternization rules banning the mingling of known and unknown PIRA
members. After cultivating a very public image, Fatah leaders tried to increase the
group’s secrecy in the early 1970’s but found it difficult to ‘go back underground’ after
exposing the group’s leaders and organizational structure to the public. Al Qaeda leaders
were in frequent contact with journalists, media organizations, and group members in the
West had regular liaison contact with the media. Bin Laden routinely leaked valuable
358
information about his health, locations, and operational intentions in video interviews and
tapes released to media organizations. The Islamic Group routinely reached out to local
and international media outlets, telephoning and faxing media offices and granting
interviews with journalists. All of this behavior risked exposing sensitive details about
Islamic Group personnel and resources to the Egyptian Government.
Casual Mechanisms. The case studies point to several driving forces behind these
outcomes. First, local populations that support a terrorist group will take a risk in
providing material support to that group. As the risk of being detected by the adversary
providing support decreases, it is likely that the instances and boldness of support will
increase. Additionally, as the popularity of the group increases, it is likely that the
instances and boldness of the support will also increase. Though the study did not test
these hypotheses, it stands to reason that decreasing counterintelligence support to
terrorist groups must involved either increasing the risk of detection or decreasing the
popularity of the terrorist group.
Second, the process of winning popular support almost requires that terrorist
group divulge sensitive details about its plans, personnel and organization to the public.
Population are often motivated by the human dimension of the terrorist group’s cause—
the personal struggle of the groups leader, the inspiring and daring plan to defeat the
adversary, and the success and methods of recent attacks and victories. Terrorist group
leaders are occasionally seduced by their base of support as well and end up offering
valuable intelligence on the goals and health of the organization to their adoring
populations and watchful adversaries alike. Terrorist groups sometimes earn popular
359
support by default when a clumsy adversary alienates the population with heavy-handed
tactics. This popular support windfall comes with a price, however, as the shots of a
heavy-handed adversary frequently cause damage to both the offending terrorist group
and the bystander population.
Popular Support and Counterintelligence. Popular support and the processes
required to gain and maintain popularity can both alleviate and create counterintelligence
problems for a terrorist group. For most terrorist groups, gaining popular support is
essential to survival and the counterintelligence loses incurred in the process are
necessary concessions. Fatah’s leader Arafat embarked on a popular support campaign in
Jordan when he recognized that failure to gain popular support in the West Bank had
been one of Fatah’s early downfalls.1307 Fatah soon began to fear, however, that Israeli
assassination squads were exploiting Fatah’s openness to track down its leaders.1308
Popular support offers terrorist groups numerous, alluring benefits. Support
frequently results in increased recruitment. Bin Laden’s reputation was an important
factor in drawing militants to Afghanistan. Journalist Peter Bergen argues that,
“something of a bin Laden cult was taking shape in [this] period” which “helped fuel an
unprecedented volume of recruits to al Qaeda’s camps.”1309 Support also ensures that
local populations and members of the terrorist group are less likely to defect to and spy
for the adversary.
1307 Yaari, 245. 1308 O’Ballance, 87. 1309 Bergen (2006), 258.
360
Importantly, for clandestine organizations there is a natural tension between
secrecy and popularity. Fatah encountered enormous popular support difficulties when it
prized secrecy over all other goals. One Fatah member recalled of Fatah’s secrecy
obsession in the 1964 to 1967 period: “We kept our secrets so close that the word Fatah
would not be mentioned except to a member. Only Fatah members could see our two
basic documents, the organizational structure and the political program.”1310 The PIRA
considered its compartmentation in the mid-1970s a net gain for counterintelligence, but
it also felt the drain on its popular support. One PIRA member noted that increased
secrecy drew PIRA volunteers away from daily interaction with the average citizen of
Northern Ireland and that less contact with the population eventually resulted in less
familiarity and trust between the PIRA and its base of popular support.1311
Reviewing the Hypotheses: Controlled Territory
Hypothesis 3(A): A terrorist group with controlled territory, relative to one
without territory, will have superior communications security, physical security and
counterintelligence vetting. The study supports this hypothesis. The large data set
showed that groups with controlled territory tend to have better communications security.
The PIRA’s controlled territories allowed the group to more effectively train its members
and coordinate its operations to mitigate their counterintelligence vulnerabilities. Fatah
also enjoyed superior security in its controlled territories. Israel found it difficult to track
and assassinate Fatah leaders in Lebanon as they were surrounded by bodyguards and
1310 Ibid, 24. 1311 O’Brien, 161.
361
were able to move between safe houses with ease. Operation Spring of Youth, where
Israeli special forces units raided an apartment in Beirut and killed several high-ranking
Fatah members, is an example of where Israel took the risk of attacking within Fatah’s
controlled territory. The half-hour-long operation cost Israel the lives of two of its
soldiers as well as hundreds of hours of surveillance of buildings and neighborhoods.1312
In contrast, Israel monitored and attacked Black September leaders in Europe with
relative ease once these individuals had been located. When al Qaeda controlled territory
in Afghanistan, top leaders were able to change their location every evening, lowering the
chances they could be tracked by a single informant and targeted for a missile strike. Al
Qaeda’s communications security was also better in its controlled territory. Members
could meet face-to-face and did not have to rely on means of communications that could
be intercepted. For the Islamic Group, Egyptian security forces could not adequately
police the group’s controlled territories and had to rely on mass sweeps and raids when
venturing into Islamic Group areas. Police raids on this scale may have been easy to
predict and may have given key leaders and operatives a chance to hide or escape police
round-ups. On the other hand, the controlled territories gave security forces an area to
target, and mass arrests almost certainly netted some operatives and Islamic Group
sympathizers.
Hypothesis 3(B): A terrorist group with controlled territory, relative to one
without territory, will be more vulnerable to its adversary’s efforts to track the group’s
gross financial, logistical and personnel movements. The study mostly supports this
1312 Klein, 160.
362
hypothesis. British security forces were consistently able to produce intelligence from
close observation of areas of high PIRA member concentration. Checkpoints and
surveillance cameras near urban controlled territories allowed known PIRA members to
be tracked and suspected PIRA members to be monitored for connections to confirmed
PIRA entities. For Fatah, its adversary Israel could relatively easily monitor the borders
of its controlled territories and thereby estimate Fatah’s manpower and weapons supplies.
In contrast, the rank-and-file members of Black September were more anonymous and
hidden among tens of thousands of non-combatants with similar biographical profiles. In
many cases Black September operatives were also legitimate students and workers, and
Black September operatives who participated in only one mission would leave very few
operational footprints. Thus, the difficulty of locating Black September operatives made
estimation of the group’s overall manpower, communications and weapons supplies at
any time very difficult. An important caveat to this hypothesis is that non-controlled
territory offers the hypothesized benefits only if the territory is not controlled by one of
the terrorist group’s adversaries. When a group’s adversary controls the territory they
operate in, group members will be easy to locate, monitor and attack.
Causal Mechanisms. The case studies point to several factors driving these
outcomes. First, controlled territory denies the adversary physical access to its most
important targets. While some intelligence and counterintelligence information can be
acquired remotely, gaining physical proximity to terrorist group personnel, meeting
venues, and popular support base is almost certainly the most important intelligence
objective for the adversary. An adversary that physically encounters terrorists can recruit
363
terrorists to spy. An adversary that gains physical access to meeting venues can monitor
those venues directly. An adversary that interacts directly with a terrorist group’s base of
support can psychologically influence that support base.
Second, controlled territory places a challenging but guaranteed high value target
directly in the adversary’s sights. The adversary will have to devote much energy to
penetrating the controlled territory but once the territory has been penetrated, the
adversary may gain access to a large percentage of its highest priority targets. In
contrast, terrorist operatives scattered across non-controlled territory will be less
predictable in their location but far more vulnerable to monitoring and attack once
located.
Finally, when physically penetrating a controlled territory is impossible,
governments may find that the high concentration of terrorist members in one area makes
them more susceptible to remote monitoring. As terrorists congregate in small areas,
governments may be able to use overhead imagery and technical measures to observe the
group’s size, key training facilities, and key meeting venues. Groups that are spread out
over large urban areas will be far less susceptible to this type of monitoring.
Controlled Territory and Counterintelligence. Whether or not a terrorist group
controls territory substantially impacts its counterintelligence strengths and
vulnerabilities.
Control territory affords terrorist groups the opportunity to live, communicate,
and train together in the open. For example, PIRA controlled territory in the countryside,
such as South Armagh, allowed the PIRA to relax its counterintelligence profile and
364
operate more openly.1313 This not only lifts the physical and financial counterintelligence
burden of hiding personnel and property but also helps to alleviate the psychological
counterintelligence burden that can wear heavily on members who would otherwise need
to live ‘in the shadows.’ Al Qaeda used its controlled territory to conduct secure training
and enhanced vetting of its recruits. Before al Qaeda recruits were granted access to the
camp they had to surrender all their personal belongings, enhancing al Qaeda’s
counterintelligence control over trainees and training venues.1314 In some cases, camp
supervisors would personally assess a new comer to determine if the recruit was sincere
in his commitment to al Qaeda’s goals.1315
Controlled territory may have the disadvantage, however, of fostering a
dangerously relaxed counterintelligence posture. For example, Bin Laden’s journey’s
within al Qaeda’s controlled territory of Afghanistan sometimes followed a predictable
path: he would move from Kandahar to Ghowr province, where there was a valley he
enjoyed visiting, and then to Jalalabad and back to Kandahar.1316 Operatives in non-
controlled territory, living on the run, are almost certainly more likely to keep a sharp
counterintelligence mentality or will risk being detected and captured in short order.
Operating in non-controlled territory can have additional counterintelligence
advantages. Primary among these advantages is the relative ease with which a terrorist in
non-controlled territory can remain anonymous and travel around undetected. For
example, Black September members participating in the group’s attack in Khartoum in
1313 Bishop and Mallie, 159. 1314 Bergen (2006), 264. 1315 Ibid, 264. 1316 Coll, 500.
365
the 1970s would have been nearly impossible to detect as six of the operatives were
flown in on Jordanian passports and briefed on the operation the day before the attack.1317
Operatives for Black Septembers operation in Munich were equally well hidden. One
Palestinian operatives had lived in Germany for five years, attended the University of
Berlin and took a job as a civil engineer in the Olympic Village to surveil BSO
targets.1318 A second Palestinian had worked for a Munich oil company and took a job in
the Olympic Village as a cook to conduct surveillance.
Operating in non-controlled territory can also pose a serious counterintelligence
risk if the territory is well policed by the adversary. For the PIRA, concentrations of its
members and supporters in non-controlled urban areas lived under constant threat of
British surveillance. One observer noted the PIRA areas of the city resembled low-
security prisons: “There were cameras and night sights, hidden spotters, bought
informants, erratic patrols and undercover police, computer banks and those who kept
track of milk delivered and clothes taken to the cleaners.”1319
The relationship between controlled territory, popular support, and the
adversary’s capabilities also offers insight into counterintelligence benefits and
drawbacks of controlled territory. On the one hand, control territory offers terrorist
groups a chance to build an invaluable local support base within the territory by
providing social services, uninterrupted and unchallenged by their adversaries. In Fatah’s
controlled territory in Jordan, the group administered its own hospitals and provided
1317 Bar-Zohar and Haber, 165. / “A Blacker September,” Time Magazine, March 19, 1973. 1318 Reeve, 2. 1319 Bell (1997), 470.
366
service to widows, orphans and the disabled.1320 Furthermore, adversary incursions into
controlled territory have the potential to backfire dramatically if the adversary’s
counterterrorism operations snare numerous innocent bystanders—a likely outcome in
territory with which security forces are not familiar—winning even more popular support
for the territory’s ‘freedom’ fighters.
On the other hand, adversary incursions into a terrorist group’s controlled territory
may pay dividends to the adversary if the incursions net high value terrorist targets.
Further, adversary incursions may alienate the population from both the adversary and
the terrorist group if the population views the terrorist group as the ultimate cause of the
raids. A variation of this predicament beset al Qaeda when it was driven from its
safehaven in Afghanistan in 2001. Even as al Qaeda portrayed itself as “David” to the
U.S.’s “Golaith”, the idea circulated in Islamic world that al Qaeda had ‘lost’ Afghanistan
with its militant attack on the United States. The Islamic Group felt this tradeoff even
more sharply as it attacked the economic base of the Egyptian government and
inadvertently undermined the economic livelihood of its local support base.
Reviewing the Control Variables
The Adversary’s Counterterrorism Capabilities. The counterterrorism
capabilities of a terrorist group’s adversary affect that group’s counterintelligence
strengths and vulnerabilities. First, strong adversaries force terrorist groups to adopt
superior counterintelligence practices or face elimination. Some of al Qaeda’s
1320 O’Ballance, 122.
367
counterintelligence awareness, for example, was a product of the guerrilla fighting and
‘underground’ experience of its members. Al Qaeda leader Ayman Zawahiri led a
clandestine underground organization in Egypt before he was sixteen and spent years
evading the Egyptian security services.1321 Thus, somewhat paradoxically, strong
adversaries play a critical role in the counterintelligence evolution of many terrorist
groups.
Terrorist Group Resources. A terrorist group’s resources can also dramatically
affect its counterintelligence strengths and weakness. For the purposes of
counterintelligence, having an abundance of resources almost certainly provides some
advantage, while having too few resources can be a fatal flaw. Terrorist groups with
meager finances may be particularly vulnerable. The PIRA suffered numerous
counterintelligence problems when they couldn’t pay their members. British forces were
able to recruit many cash-deprived young Catholics during their interrogation by offering
them a financial reward for spying on the PIRA.1322 Terrorist groups with a deficit of
recruits also face challenges. For al Qaeda, even before 2001, a limited supply of trusted
couriers almost certainly restricted the group’s ability to move messages and funds
quickly.1323
An abundance of resources can also present counterintelligence problems, if those
resources are not properly handled. Occasionally, terrorist groups take on more recruits
1321 Montasser Al-Zayyat, The Road to Al-Qaeda: The Story of bin Ladin’s Right Hand Man, (Pluto Press: London, 2004), 18. 1322 Davis, 34. 1323 Staff Report of the National Commission on Terrorist Attacks Upon the United States, “Monograph on Terrorist Financing,” 26.
368
than they can train, which lowers the group’s overall counterintelligence standards.
Relying too heavily on a state sponsor for resources also ushers in counterintelligence
problems. A key vulnerability is that terrorist groups sometimes share with their state
sponsor information about their leaders, personnel, facilities, training and military
capabilities. Al Qaeda’s close relationship with the Sudanese and Taliban governments
frequently exposed al Qaeda’s most sensitive personnel and activities to many
government officials that did not favor al Qaeda’s cause. The US cruise missile strikes in
Afghanistan in 1998 taxed the patience of many Taliban officials.1324 Bin Laden further
antagonized some Taliban officials by giving an inflammatory interview to Al Jazeera’s
bureau chief in Pakistan in December 1998.1325 An adversary that cannot infiltrate the
terrorist group, thus, may gain access to such information through penetrations of the
state sponsors security and police service, whose members may be more susceptible to
standard recruitment techniques.
Organizational Learning. An organization will inevitably learn over time and as
a result improve its counterintelligence capabilities. While the study demonstrated that
the core variable changes were necessary for the observed counterintelligence
improvements, a terrorist group must also intentional seize the opportunity to adopt and
embrace these improvements. This action is, in part, organizational learning. Thus,
counterintelligence improvements linked to variable changes cannot be completely
isolated from normal organizational learning. For example, the PIRA recognized the
need to improve counterintelligence by tightening its command and control and
1324 Burke, 164. 1325 Bergen (2006), 241.
369
intentionally shifted its organizational structure to meet this need. Fatah recognized the
operational counterintelligence benefits of operating outside of its controlled territory and
created Black September to capitalize on these benefits.
Reviewing the Alternative Hypotheses
Throughout the study, a number of alternative hypotheses were considered to
explain terrorist group behavior. The alternative hypotheses contradicted the core
hypotheses, positing that there were no significant relationships between the independent
and dependent variables. The review of the hypotheses above clearly demonstrates that
hypothesized effects of the independent variables were mostly correct. Therefore, the
alternative hypotheses are proven incorrect. Alternative explanations for observed
outcomes, mostly derived from movement in the control variables, were individually
dealt with and by in large discarded in each chapter. However, one major challenge
remains for the core hypotheses—do the hypothesized effects only hold true for mature
terrorist groups?
As discussed in the first chapter, mature terrorist groups (i.e. groups that survive
past their first few years of existence) are overrepresented in the data sample. Thus, our
results potentially to apply mostly to mature groups. For example, mature terrorist
organizations may standardize training and counterintelligence procedures more
effectively with a tight organizational structure, while immature groups may fail to
standardize procedures regardless of organizational structure. Mature groups tend to
tighten their command structure in response to external threats while immature groups
370
may fail in this task. All of these ‘failures’ of immature groups may contribute to their
rapid demise.
The subset of immature terrorist groups in the large data set shed some light on
this question. First, all of the immature groups in the sample were decisively outmatched
from the start by their respective state adversary. None of the groups had a real shot at
surviving once they initiated the war against their very capable adversary. The more
proximate sources of their failures were poor leadership, weak causes and insufficient
local support. The subset of immature terrorist group cases support some of the predicted
outcomes of the core hypotheses—weak popular support and lack of controlled territory
are correlated with counterintelligence disadvantages. Interesting, each one of the three
immature groups exposed themselves extensively to the media, even when they did not
have popular support.
Close examination of the case studies also sheds light on this question. A tight
organizational structure is one that empowers its leaders, regardless of their leadership
skill and intelligence. Thus, terrorist groups will be led, and misled, in their
counterintelligence posture under a tight organizational structure. A subset of immature
terrorist group leaders probably choose not to train their members in counterintelligence
procedures and thus make themselves easier targets.
Thus, it appears as though the hypothesized mechanisms are mostly universal, but
may not apply to terrorist groups that whose leaders are ignorant of, or chose not to
adopt, counterintelligence practices. Furthermore, as discussed earlier, the hypotheses
371
may not apply to groups that operate in uncontrolled territory that is effectively policed
by the adversary.
From Practice to Theory
The study offers a variety of insights into the terrorism, intelligence and
organizational theory literatures. To the terrorism literature it adds a unique framework
for predicting terrorist group behavior, decision-making and vulnerabilities. The study
suggests that a terrorist group’s organizational structure, popular support and controlled
territory significantly affect the group’s strategic options and overall strengths and
weaknesses.
The terrorism literature is enriched by the introduction of the concept of
controlled territory. The conventional way of dealing with the geographic location of
terrorist groups is with the concept of safehaven. While safehaven defines whether or not
a group is sheltered from general harassment from any variety of adversaries, it does not
describe how the group was able to gain or maintain this geographic space. The concept
of controlled territory provides more granularity on the circumstances of the group’s
territory and a useful starting point for estimating the group’s local support base,
capabilities and resources.
The terrorism literature is also enriched by the exploration of the drawbacks of
popular support. While the literature frequently highlights the benefits of popular support
to armed movements, theoretical exploration of the downsides of popular support is
almost non-existent. The study vividly demonstrates that terrorist groups frequently pay
a heavy, though occasionally acceptable, price to gain and maintain popular support.
372
To the intelligence literature, the study offers a framework for systematic
examination of counterintelligence behavior in a variety of organizations. Theoretical
frameworks are rare in the intelligence literature as most studies on intelligence recount
on a single case study or weigh in on a narrowly focused policy question. There is a
myth that intelligence cannot be studied because the world of intelligence is hidden and
secret. To the contrary, with a bit of historical distance significant portions of the history
of intelligence in the West, and even those of formerly closed Eastern and Communist
societies, are available in open sources and special public archives. There remain a large
number intelligence questions unanswered, but susceptible to historical analysis: What
determines how a state conducts intelligence activities? How do a state’s resources,
geopolitical agenda, and culture shape its intelligence collection capabilities and
weaknesses? What determines how a state conducts counterintelligence activities? How
do a state’s resources, collection focus, and collection style shapes its counterintelligence
strengths and vulnerabilities?
To the organizational theory, the study has much to contribute. First, the study
shows that the basic insights organizational theorists have posited about the dynamics of
centralization, coordination and control also hold true for terrorist groups. This is an
interesting testament to the universal applicability of these organizational theories.
Second, the study offers strong support to the threat-rigidity hypothesis. The threat-
rigidity hypothesis posits that group under threat tend to tighten their command structure,
resulting from the desire of the group’s leaders to consolidate control over the
organization. The large data set shows that mature terrorist groups tend to be tightly
373
structured. The case studies show that terrorist groups over time tend to become more
tightly structured. The case studies also show that the driving force behind organizational
tightening may frequently reflect the desire of the core group leaders to increase their
ability to control and coordinate organizational activities.
These insights add a wrinkle to the debate on networks and ‘netwars’.
Organizational theorists David Ronfeldt and John Arquilla have argued that less
hierarchical, more ‘networked’ forms of organization may be better suited for survival,
and are increasingly common, in the globalization age.1326 In fact, an organization’s
unique environmental circumstances and counterintelligence demands will determine
whether the organization should, normatively, adopt a tight or loose organizational
structure. In many cases, a tighter organizational structure will enhance the terrorist
group’s ability to stay hidden and complete its mission.
Counterintelligence and Terrorist Groups: Exploiting the Vulnerabilities
Understanding the mechanics of terrorist group counterintelligence allows for
more efficient exploitation of terrorist counterintelligence vulnerabilities. Exploitation of
terrorist group counterintelligence vulnerabilities can lead to improvements in
intelligence collection on terrorist group personnel, activities and intentions, which
ultimately leads to improved counterterrorism operations. The following subsections
describe a number of ways counterintelligence vulnerabilities can be exploited to
1326 Networks and Netwars: The Future of Terror, Crime and Militancy, David Ronfeldt and John Arquilla, The Rand Corporation, 311.
374
improve intelligence collection on and counterterrorism operations against terrorist
groups.
Enhancing Paranoia and Mistrust. Secret organizations are by their nature prone
to paranoia, mistrust and conspiracy. The common practice of compartmentation—the
act of restricting information flow to prevent information leakage—testifies to the fact
that the organization believes some percentage of its members cannot be trusted with
sensitive information. Organizations often engage in ‘mirror imaging’ their own
conspiratorial strategies and plotting mindset onto their adversaries. As a secret
organization faces existential crises and serious loses at the hand of its adversary, the
organization’s tendency to mistrust members who may be trustworthy and perceive
conspiracies where there may be none, will grow. The tendency towards paranoia and
mistrust, particular in hard times, offers fertile ground for governments to disrupt and
manipulate terrorist group behavior.
Sowing discord and mistrust in terrorist groups has yielded tremendous gains
historically. The British frequently employed these techniques against the PIRA. For
example, the British would announced that informant information had led to an arrest,
when it had not, or would announce an exaggeratedly high figure for the spoils of a PIRA
bank robbery, which sometimes resulted in a spate of internal PIRA punishment
shootings.1327 A PIRA spokesperson summed up the damage: “[The British] almost
destroyed us. They created paranoia in the ranks and left us severely damaged.”1328
1327 Bishop and Mallie, 187. 1328 Coogan, 267.
375
Increasing mistrust in terrorist groups can be achieved in numerous ways. First,
every government should understand how its terrorist adversary conducts internal
investigations—how do members come under suspicion of betrayal? Which members are
already suspected of divided loyalty? What assumptions does the group have about its
own informant vulnerabilities? For example, if members often come under suspicion by
mishandling finances or having unexplained wealth, the government can provide a
targeted member and his family with unexplained ‘contest’ winnings, scholarships, or
gifts. Targeting members who are already under suspicion of divided loyalty will be
particularly vulnerable to this approach. If a group assumes that its foreign operatives are
more susceptible to recruitment by a foreign power, claim publicly that a record number
of foreign operatives have been recruited this year or that a particular foreign operative
has provided sensitive details of the group’s internal dynamics. All of these paranoia-
inducing untruths are more likely to work if they fit into the terrorist group’s assumptions
about its own vulnerabilities.
The quasi-omniscient mystique that some government security agencies possess
may offer a second avenue for sowing discord and confusion within terrorist groups.
Many terrorist groups assume that their state adversary occasionally lives up to the quasi-
omniscient reputation that the popular media and culture tend to promote. Governments
may benefit from augmenting this popular belief as terrorist group expend valuable
resources to protect against illusory intelligence capabilities. Terrorist groups that
assume their adversary has near-omniscience will be more likely to believe the adversary
regularly compromises group members and critical internal communications pathways.
376
Governments could use agents within terrorist groups to spread rumors about
‘compromises’ of sensitive information that could only have resulted from an novel
government collection capability. Many groups would likely respond by scaling back a
wide variety of operations and activities that could have been compromised by the novel,
but ultimately illusory, capability. Groups that naturally assume their adversary is highly
capable and cunning will more easily fall into this trap.
Exploiting the Publicity Craving. If there is one affliction that all terrorist groups
suffer from, it is the craving for publicity. The craving typically afflicts the group’s
leaders most severely and directly cuts against the group’s need for secrecy and
discretion.
Terrorist group leaders may come to believe their own rhetoric that they are the
saviors of the populations whose grievances they promise to right. Leaders may also
become fascinated with their newfound stardom. Regardless of cause, group leaders
frequently are seduced by an adoring population’s demands for information about their
life, activities, and the group’s plans and personnel more generally. Bin Laden became
close to Saudi Arabian journalist Jamal Khashoggi, for example, to whom Bin Laden
proudly recounted his exploits in Afghanistan.1329 Fatah leader Yassir Arafat was also
easily seduced by his popular support base and provided the local media with sensitive
details, which in turn allowed the Israelis to more easily track down Fatah leaders.
Individual group members can also fall victim to this seduction. Clandestine members of
1329 Wright, 199.
377
the PIRA marked a Treaty negotiation victory by emerging public to celebrate with their
support base and known PIRA members, all in plain sight of the British.
Governments should encourage this type of behavior by cultivating in terrorist
group leaders the conviction that their support base requires this type of close interaction.
Group leaders should believe that their personal story is uniquely compelling and that
they are uniquely capable of delivering the group’s narrative to the media. Group leaders
with a messianic self-image will almost certainly be more open to sharing details about
themselves, the terrorist group and its operational and strategic victories over the
adversary. Cultivating the same sense of egotism in up-and-coming leaders may serve to
increase damaging group publicity while simultaneously encouraging the formation of
rifts and challenges to top group leaders.
Part of this strategy may require an examination of current policies on censoring
terrorist group propaganda. In some cases, allowing terrorist websites the flourish and
propaganda videos to stir up targeted population may produce some critical
counterintelligence vulnerabilities in the long run.
Enhancing the Allure of the Common Comforts. Terrorist group members
typically do not lead normal, comfortable lives. They may live for decades without
family contact, the comforts of good food and relaxation, recognition for their life’s
work, or even a daily routine—all of which takes a psychological toll. Terrorists with an
apocalyptic mindset may be less drawn to these psychological necessities, but terrorist
that are less convicted of this, or simply tired of living on the run, may be drawn to these
comforts.
378
Persuading terrorists to indulge in these comforts will improve intelligence
collection against them. Even for many hardened terrorists, relatives are the proverbial
watering hole to which they will periodically return. Recruiting family members will be
one way for governments to exploit this familial contact. Simply watching family
members may be another strategy. For example, an Israeli assassination squad was able
to assassinate its arch nemesis, Ali Hassan Salameh, as he visited his niece on her
birthday.
When terrorists cannot reach out to family members and friends, they often
increase their dependence on other terrorist group members. The al Qaeda members of
the Hamburg cell involved in the 9/11 attacks frequently emailed one another to share
experiences and jokes, which helped them foster and maintain an emotional closeness.1330
This closeness led to informality and increase non-essential communication, which could
produce counterintelligence vulnerabilities. The comfort of close friendships is a
vulnerability governments can directly encourage and exploit. Terrorist operatives may
experience an especially pronounced loneliness when they are deployed in foreign
theaters of operation and therefore will be more susceptible to government operations that
encourage non-essential communications.
Terrorist operatives in controlled territory may be particularly susceptible to
‘comfort’ campaigns. Controlled territory can provide terrorists a sense of security and
lure them into relaxing their counterintelligence posture. Journalist Steve Coll reported
that Bin Laden’s journey’s within al Qaeda’s controlled territory in Afghanistan
1330 Sageman, 159.
379
sometimes followed a predictable path: he would move from Kandahar to Ghowr
province, where there was a valley he enjoyed visiting, and then to Jalalabad and back to
Kandahar.1331 This routine was a counterintelligence risk for Bin Ladin as his
movements could be more easily predicted at times.
Prisons pose a similar risk to terrorist groups as they occasionally think of prisons
as a quasi-controlled territory. The PIRA frequently relied on its prison-based members,
who gathered in ‘think-tanks’ to perform some of the group’s long-term
counterintelligence and political analysis.1332 Reinforcing the sense that prisons are a
‘safe and secure’ venue for terrorist inmates to plot and analyze information can
substantially improve intelligence collection on terrorist groups. If terrorist groups are
sufficiently harassed outside prison walls and key terrorist leaders are confined within
prison walls, terrorist groups may find that prisons are one of the few venues available for
long-term face-to-face communications. For this reason, governments may not always
want to prevent terrorists in prison from communicating with one another or even the
outside world. This will allow government to capture essential details of the terrorist
groups key plots and strategies. The need to develop routine and find comforts may be
particularly acute for terrorist members serving long prison terms.
Indulging in the luxuries of relaxation and routine can often compromise a
terrorist’s counterintelligence profile. So how would a government wage a comfort
campaign? An obvious method would be to keep a group under siege to the point where
enjoying any comforts becomes difficult without compromising the group’s
1331 Coll, 500. 1332 Maloney, 134.
380
counterintelligence posture. Another method would be to rely on traditional advertising
strategies for selling such comforts, though instead of selling a Mercedes the campaigns
would highlight the subtle and culturally distinct comforts of home, whatever they may
be.
Exploiting Greed and Self-Interest. Terrorists, and extremist fundamentalist
terrorist in particular, are often described as possessing unflinching dedication to their
terrorist cause. However, history has shown that even the most ideologically-extremist
terrorist groups contain members who can be motivated to betray their group to exercise
their greed, interpersonal vendettas or a need for respect For example, one of Bin
Laden’s personal pilots, L’Houssaine Kherchtou, turned on al Qaeda and volunteered
himself to U.S. officials after Bin Laden refused to give him $500 for his wife’s
Caesarean section.1333 The British found that they were able to recruit many cash-
deprived young Catholics during interrogations by offering them a financial reward for
spying on the PIRA.1334 The trick to this method is finding the terrorist group members
that have the motivation to comprise the group for their own personal gain. Governments
may find that groups going through ideological flux or lean financial times will be more
likely to produce members that are not satisfied with the group’s leaders or treatment of
group members.
Exploiting Points of Exposure. Governments may find that their terrorist group
adversary has very few counterintelligence weak points. Fortunately, terrorist groups
frequently expose themselves to a variety of ‘liaison’ partners, state sponsors, and other
1333 Wright, 197. 1334 Davis, 34.
381
political entities whose counterintelligence postures may be far weaker than that of the
terrorist group. For example, al Qaeda provided its Sudanese liaison partners with
volumes of sensitive data about its members and capabilities. Governments may gain
access to a significant portion of these secrets by penetrating the weaker liaison partners
rather than trying to penetrate the terrorist group itself.
Terrorist groups occasionally create, or at least consort with, a political wing to
carry the burden of generating popular support and negotiating with adversary politicians.
These political wings are occasionally created to minimize the exposure of the
clandestine wings operatives and leaders. However, the political wings often have less
sophisticated counterintelligence procedures and assume some level of exposure to the
adversary through regular negotiations and meetings. As the clandestine wing of the
group almost certainly shares sensitive details about its personnel and plans with the
political wing, the political wing presents a significant counterintelligence vulnerability
to many terrorist groups. Governments should focus on recruiting these individuals to
gain intelligence on the terrorist group, including which members of the clandestine wing
are most vulnerable to recruitment and manipulation.
Exploiting the Bureaucratization of Counterintelligence. Terrorist groups often
adopt counterintelligence procedures that are simple but effective. For example, groups
may only recruit individuals from a particular clan or neighborhood, dramatically
reducing the likelihood they will be directly infiltrated by the adversary.
While bureaucratization and standardization of this practice often augments
terrorist group counterintelligence, any standardized practice can become a
382
counterintelligence vulnerability if it is studied and covertly circumvented by the
adversary. This can be particularly true for practices that are considered ‘simple and
effective’ because terrorist groups will be unlikely to suspect that these methods have
been defeated. For example, al Qaeda standardized the procedures by which a prospect
recruit would be vetted prior to gaining access to al Qaeda training camps in Afghanistan.
1335 A clever adversary could have methodically studied these procedures and over time
gained a penetration of the camps by some trial and error.
Governments should look for opportunities to turn a terrorist group’s standardized
and trusted counterintelligence procedures against them. Methods for identifying and
vetting new members, investigating and interrogating suspected informants, and
recruiting its own penetrations of its adversary can be mapped out and defeated over
time.
Exploiting the Tension Between Local and International Counterintelligence.
International terrorist organizations are frequently challenged by the natural tension
between its local and international counterintelligence and security posture—that is,
moves to strengthen security and counterintelligence in their controlled territory can often
produce vulnerabilities in the security and counterintelligence of their international
operations, and vice versa.
For example, al Qaeda members were told to disperse from camps before major
attacks, which could have compromised operational security for international cells had al
Qaeda camps been penetrated or monitored at the time. Conversely, international
1335 The 9/11 Commission Report, 67.
383
security procedures sometimes create local security challenges. For example, as Fatah’s
international operatives occasionally hid from their pursuers in Fatah controlled territory
in Lebanon, and as a result brought additional, and frequently deadly, scrutiny to these
controlled territories. Groups using international couriers to communicate more securely
and directly with leaders in the controlled territories may in fact highlight those perhaps
previously unknown couriers, territories and destinations to interested governments.
International terrorist groups also must weigh the tradeoffs between secrecy and
counterintelligence on the one hand, and geographic striking range, command and
control, and scale of attack on the other. Tightly commanding a widely dispersed
terrorist group that aims to conduct spectacular attacks is an enormous
counterintelligence challenge. Decentralizing command, diminishing geographic range,
or scaling back on attacks will relieve some of this counterintelligence burden.
Governments may find that intelligence victories against an international terrorist group
result in these alleviating behaviors. Conversely, long period without intelligence
victories may result in tightening of command, increased geographical dispersion and
increased planning of large scale of attacks. Understanding how a terrorist group is
evolving and adapting its counterintelligence procedures in relation to the behavior and
counterterrorism adaptations of its state adversary will allow governments to better
monitor and ultimately eliminate their targeted group.
Counterintelligence: A Discipline of Tradeoffs
384
Counterintelligence is a discipline of tradeoffs and no terrorist group, nor
government, can maintain ‘perfect’ secrecy—every soaring advantage has its
vulnerabilities. The ideal counterintelligence strategy is one that balances
counterintelligence vulnerabilities and strengths to ensure that the adversary’s
weaknesses are exploited while one’s own weaknesses are minimized.
Much like a game of chess, counterintelligence is a competitive venture where
success and failure are judged entirely with respect to the activities of the competitors.
Thus, achieving counterintelligence dominance does not require that a competitor
flawlessly manage tradeoffs, but rather that a competitor manage tradeoffs more
efficiently and cleverly than its adversary. For example, thinking of terrorist safehavens
as an indisputable good for terrorist groups is a popular, but inaccurate, sentiment. The
study has shown that controlled territory induces powerful and exploitable vulnerabilities
that can be fatal for a terrorist group if not properly understood and managed. This
stands as a reminder that no terrorist group can achieve an unassailable
counterintelligence position—every position has its vulnerabilities.
Conceiving of counterintelligence as an inherently competitive venture is not a
new idea. For centuries governments have shaped their intelligence and
counterintelligence organizations in direct relation to the perceived capabilities of their
adversary’s intelligence organizations. Though terrorist groups differ in many ways from
a traditional state intelligence service the two entities share many core behaviors and
strategies—collecting secrets, recruiting clandestinely, and hiding plans and activities
from adversaries in hot pursuit. Thus, the study of counterterrorism and the study of
385
counterintelligence are natural companions and the lessons learned from each discipline
have much to offer the other. Importantly, one key to success in both endeavors is the
recognition that almost every move has its counterintelligence advantages and
disadvantages. Incorporating these insights into current counterterrorism efforts promises
to add inventive methods for monitoring and eliminating terrorist groups.
386
BIBLIOGRAPHY Aburish, Said K. Arafat: From Defender to Dictator. Bloomsbury: New York. 1998. Al-Awadi, Hesham. In Pursuit of Legitimacy : The Muslim Brothers and Mubarak, 1982-2000. London, GBR: I. B. Tauris & Company, Limited, 2005. Alexander, Yonah. Counterterrorism Strategies: Successes and Failures of Six Nations. Potomac Books, Inc.: Washington, DC, 2006. Al-Hadlag, Abdulrahman. Repression and Peoples’ Political Violence in Egypt: The Case of al-Jama’a al-Islamiyya. Ph.D. diss., University of Idaho, 1994. Al-Zayyat, Montasser. The Road to Al-Qaeda: The Story of bin Ladin’s Right Hand Man. Pluto Press: London, 2004. Anderson, Brendan. Joe Cahill: A Life in the IRA. The O’Brien Press: Dublin, 2002. Andrew, Christopher M. and Vasili Mitrokhin. The World Was Going Our Way: The KGB and the Battle for the Third World. Basic Books: New York, 2005. Anonymous. Imperial Hubris: Why the West is Losing the War on Terror. Brassey’s, Inc: Washington, DC, 2004. Arbuckle, Tammy. Egypt’s Catch-22. Jane’s International Defense Review, 1993. Atwan, Abdel Bari. The Secret History of al Qaida. Saqi Books: London, 2006. Al Battar Training Camp Mu’askar Al-Battar, Issues 3, 6, 9, 10, 16, 17, 22. Accessed 2004. Al Battar Training Camp: Issue 10, May. 23, 2004, Provided by SITE, RAND Voices of Jihad Database. “A Blacker September.” Time Magazine, (March 19, 1973). Baker, Wayne E. Robert R. Faulkner. “The Social Organization of Conspiracy: Illegal Networks in the Heavy Electrical Equipment Industry.” American Sociological Review, Vol. 58, No. 6, (December 1993). Bakier, Abdul Hameed. “The Evolution of Jihadi Electronic Counter-Measures.” Terrorism Monitor. Volume IV, Issue 17, (September 8, 2006).
387
Baligh, Dalia. “Crackdown on Extremists Winds Down in Cairo Neighborhood.” The Associated Press. (December 15, 1992). Bar-Zohar, Michael and Eitan Haber. The Quest for the Red Prince. William Morrow and Company, Inc.: New York, 1983. Bavly, Dan and Eliahu Salpeter. Fire in Beirut: Israel’s War in Lebanon with the PLO. Stein and Day Publishers: New York, 1984. Becker, Jullian. The PLO: The Rise and Fall of the Palestine Liberation Organization. St. Martin’s Press: New York, 1984. Benjamin, Daniel and Steven Simon. The Age of Sacred Terror. Random House: New York, 2002. Bergen, Peter. The Osama bin Ladin I Know: An Oral History of the al Qaeda Leader. Free Press: New York, 2006. Bergen, Peter. Holy War, Inc.: Inside the Secret World of Osama Bin Laden. Simon and Schuster: New York, 2001. Bergen, Peter. “The Long Hunt for Osama.” The Atlantic Monthly. October 2004. Bishop, Patrick, and Eamonn Mallie. The Provisional IRA Heinemann. London: 1987. Blanchard, Christopher M. “Al Qaeda: Statements and Evolving Ideology.” Congressional Research Service. Order Code RS21973, (November 16, 2004). Bloom, Mia M. “Palestinian Suicide Bombing: Public Support, Market Share, and Outbidding.” Political Science Quarterly. Vol. 119, Iss. 1, (Spring 2004). Bobbitt, Randolph H. Jr, and Orlando Behling, “Organizational Behavior: A Review of the Literature.” The Journal of Higher Education. Vol 52, No 1, (January – February 1981). Bodansky, Yossef. Bin Ladin: The Man Who Declared War on America. Prima Publishing: Roseville, CA, 2001. Bowden, Mark. “Jihadists in Paradise.” The Atlantic Monthly. (March 2007). Brachman, Jarret M. “High-Tech Terror: Al-Qaeda’s Use of New Technology.” The Fletcher Forum of World Affairs, Vol. 30:2 (Summer 2006).
388
Brachman, Jarret M. and William F. McCants, “Stealing Al-Qa’ida’s Playbook, February 2006.” Combating Terrorism Center at West Point. Brass, Daniel J., Kenneth D. Butterfield, Bruce C. Skaggs. “Relationships and Unethical Behavior: A Social Network Perspective.” The Academy of Management Review. Vol. 23, No. 1, (January 1998). Bromley, David G. “Linking Social Structure and the Exit Process in Religious Organizations: Defectors, Whistle-Blowers, and Apostates.” Journal for the Scientific Study of Religion. Vol. 37, No. 1. (Mar. 1998). Burke, Jason. Casting a Shadow of Terror. I.B. Taurus: London, 2003. Byman, Daniel. Deadly Connections: States that Sponsor Terrorism. Cambridge University Press: Cambridge, 2005. Byman, Daniel. “Strategic Surpirse and the September 11 Attacks.” Annu. Rev. Polit. Sci., 8 (2005): 145–70. Carlough, Montgomery. Pax Britannica: British Counterinsurgency in Northern Ireland. 1969-1982, Dissertation, Yale University, 1994. Chattopadhyay, Prithviraj, William H. Glick, George P. Huber. “Organizational Actions in Response to Threats and Opportunities.” The Academy of Management Journal. Vol. 44, No. 5., (Oct. 2001). Chauhan, Sharad S. The al Qaeda Threat. APH Publishing House: New Delhi, 2003. Ciaran de Baroid, Ballymurphy and the Irish War. Pluto Press: London, 2000. Clapman, Christopher ed. African Guerillas. Oxford: James Currey, 1998. Clark, Robert. The Basque Insurgents: ETA 1952-1980. University of Wisconsin Press, Madison, 1984. Clarke, Liam. Broadening the Battlefield: The H-Blocks and the Rise of Sinn Fein. Gill and Macmillan: Dublin, 1987. Coll, Steve. Ghost Wars: The Secret History of the CIA, Afghanistan and Bin Laden, from the Soviet Invasion to September 10, 2001. The Penguin Press: New York, 2004. Colonel Michael Dewar. The British Army in Northern Ireland. Arms and Armour Press: UK, 1996.
389
Combating Terrorism Center Department of Social Sciences United States Military Academy. Harmony and Disharmony: Exploiting al-Qa’ida’s Organizational Vulnerabilities. Document Archive accessed on February 14, 2006. Coogan, Tim Pat. The Troubles: Ireland’s Ordeal 1966-1996 and the Search for Peace. Roberts Rinehart Publishers, USA: 1996. Coogan, Tim Pat. The IRA: A History. Roberts Rinehart Publishers: Colorado, 1993. Cooley, John K. Green March, Black September. Frank Cass: London, 1973. Corbin, Jane. Al-Qaeda: In Search of the Terror Network that Threatens the World. Thunder’s Mouth Press: New York, 2003. Corman, Steve R. and Jill S. Schiefelbein. “Communication and Media Strategy in the Jihadi War of Ideas.” Consortium for Strategic Communication. Arizona State University, (April 20, 2006). Cronin, Audrey Kurth. “How al-Qaida Ends; The Decline and Demise of Terrorist Groups.” International Security. (Summer 2006). Crozier, Brian ed. “Since Jordan: The Palestinian Fedayeen.” Conflict Studies No. 38, (September 1973). CSIS, “Irish Nationalist Terrorism Outside Ireland: Out-of-Theatre Operations 1972-1993.” Commentary, No. 40. (February 1994). Cullison, Alan. “Inside Al-Qaeda’s Hard Drive.” The Atlantic Monthly. (September 2004). Davidson, Charles. Political Violence in Egypt: A Case Study of the Islamic Insurgency 1992-1997. Ph.D. diss., Turfs University, 2005. Davis, Nicholas. Ten Thirty Three: The Inside Story of Britain’s Secret Killing Machine in Northern Ireland. Mainstream Publishing: Edinburgh, 1999. Dawoud, Khaled. “The Battle for the Mosque: Government vs. Extremists.” The Associated Press. (December 24, 1993). Dobson, Christopher. Black September: Its Short Violent History. Macmillan Publishing Co., Inc: New York, 1974. Dunn, Michael Collins. “Fundamentalism in Egypt.” Middle East Policy 2, no. 3 (1993).
390
El-Rayyes, Riad and Dunia Nahas. Guerrillas for Palestine. Portico Publications: London, 1976. English, Richard. Armed Struggle: The History of the IRA. Oxford University Press: New York, 2003. Erickson, Bonnie H. “Secret Societies and Social Structure.” Social Forces. Vol. 60, No. 1, Sep., 1981. Feldman, Allen. Formations of Violence: The Narrative of the Body and Political Terror in Northern Ireland. University of Chicago Press: Chicago, 1991. Fisk, Robert. “Might of the Sword Menaces Christians.” The Independent. (February 9, 1995). Fisk, Robert. “Terror Stalks Egypt’s Forgotten Towns.” The Independent. (February 8, 1995). Gabriel, Richard A. Operation Peace for Galilee: The Israeli-PLO War in Lebanon. Hill and Wang: New York, 1984. Gates, Scott. “Recruitment and Allegiance: The Microfoundations of Rebellion.” The Journal of Conflict Resolution, Vol. 46, No. 1, (Feb. 2002). Geraghty, Tony. The Irish War. HarperCollins Publishers, London, 1998. Gilles, Kepel. The Roots of Radical Islam. Saqi Books: London, 2005. Gladstein, Deborah L., Nora P. Reilly. “Group Decision Making under Threat: The Tycoon Game.” The Academy of Management Journal. Vol. 28, No. 3, (Sep., 1985). Greer, Steven. “Towards a Sociological Model of the Police Informant.” The British Journal of Sociology. Vol. 46, No. 3. (Sep. 1995). Gunaratna, Rohan. Inside Al Qaeda: Global Network of Terror. Columbia University Press: New York: 2002. Hansen, Wendy L., Neil J. Mitchell, Jeffrey M. Drope. “The Logic of Private and Collective Action.” American Journal of Political Science. Vol. 49, No. 1., (Jan. 2005). Hawthorn, H. B. “A Test of Simmel on the Secret Society: The Doukhobors of British Columbia.” The American Journal of Sociology, Vol. 62, No. 1, (Jul 1956).
391
Hazelrigg, Lawrence E. “A Reexamination of Simmel's ‘The Secret and the Secret Society’: Nine Propositions.” Social Forces. Vol. 47, No. 3. (Mar. 1969). Herbst, Jeffrey. “African Militaries and Rebellion: The Political Economy of Threat and Combat Effectiveness.” Journal of Peace Research. Vol. 41, No. 3., (May 2004). Hoffman, Bruce, “Combating Al Qaeda and the Militant Islamic Threat.” Testimony presented to the House Armed Services Committee, Subcommittee on Terrorism, Unconventional Threats and Capabilities on February 16, 2006. Hoffman, Bruce. “All You Need is Love: How the Terrorists Stopped Terrorism.” The Atlantic Monthly. (December 2001). Hoffman, Bruce. The Modern Terrorist Mindset, In Terrorism and Counterterrorism: Understanding the New Security Environment. ed. RD Howard, RL Sawyer. Guilford CT: McGraw Hill, 2002. Hoffman, Bruce. “The Use of the Internet by Islamic Extremists.” Before the Permanent Select Committee on Intelligence United States House of Representatives, May 4, 2006. Hoffman, Bruce. Inside Terrorism. Victor Gollancz, London: 1998. Horowitz, Ruth. “Community Tolerance of Gang Violence.” Social Problems. Vol. 34, No. 5. (Dec. 1987). Huband, Mark. “Luxor Masterminds in Afghanistan Exile.” The Financial Times of London. (November 20, 1997). Ibrahim, Youssef M. “Egyptian Police, Sweep, Seize Suspects in Killing of Greeks.” The New York Times. (April 20, 1996). IntelCenter, al Qaeda Messaging/Attacks Timeline v5.0 Public release Version, 29 Septmeber 2006, IntelCenter/Tempest Publishing, LLC. Intelcenter, al Qaeda Warning Cycle Completion for CONUS, v1.1, 9 Dec 2005. IntelCenter, al-Qaeda Attack/Messaging Statistics v.1.0, 22 August 2003. IntelCenter, al-Qaeda Operational Tempo – Madrid Follow-on Attack Assessment – v.1.0, 14 March 2004. Interrogation of Khaled Sheikh Mohammed, US v. Mousaoui, Cr. No. 01-455-A, Defendant’s Exhibit 941.
392
Interview with Roger Cressey by the Author. 10/11/2006. J. Bowyer Bell, The IRA: 1968-2000: Analysis of a Secret Army. Frank Cass Publishers: London, 2000. J. Bowyer Bell, The Secret Army: The IRA. Transaction Publishers: New Brunswick, 1997. Jackson, Brian A., John C. Baker, Kim Cragin, John Parachini, Horacio R. Trujillo, Peter Chalk, Aptitude for Destruction, Volume Two: Case Studies of Organizational Learning in Five Terrorist Groups. RAND Corporation: Santa Monica, 2005. Jackson, Brian. “Groups, Networks or Movements: A Command and Control Driven Approach to Classifying Terrorist Organizations and its Applications to Al Qaeda.” Studies in Conflict and Terrorism. Vol 29, 2006. Jane’s Insurgency and Terrorism Database, El Gemaa el-Islamiyya. Accessed on 02/15/2007. Jane’s Terrorism and Insurgency Database. Jenkins, Brian Michael. Countering Al Qaeda. Santa Monica, CA: RAND, 2002. Johnson, Norman J., Richard H Hall, J. Eugene Haas, “Organizational Size, Complexity and Formalization.” American Sociological Review. Vol 32, No 6, (Dec 1967). Jonas, George. Vengeance: The True Story of an Israeli Counter-Terrorism Team. Simon and Schuster Paperbacks: New York, 2005. Jordan, Javier and Robert Wesley, “The Madrid Attacks: Results of Investigations Two Years Later.” Terrorism Monitor. Volume IV, Issue 5, (March 9, 2006). Kassimeris, George. Europe’s Last Red Terrorists: The Revolutionary Organization 17 November. Hurst and Company, London 2001. Kauffman, S.A. The Origins of Order. New York: Oxford University Press, 1993. Kean, Thomas H., Chair. The 9/11 Commission Report, Final Report of the National Commission on Terrorist Attacks Upon the United States. August 21, 2004. Kechichian, Joseph and Jeanne Nazimek. “Challenges to the Military in Egypt.” Middle East Policy 5, no. 3 (September 1997). Kent, Robert B. “Geographical Dimensions of the Shining Path Insurgency in Peru.” Geographical Review. Vol. 83, No. 4. (Oct. 1993).
393
Kevin J. Kelley, The Longest War: Northern Ireland and the IRA. Lawrence Hill and Co.: Westport, Connecticut, 1988. Kienle, Eberhard. Grand Delusion : Democracy and Economic Reform in Egypt. London: I.B. Tauris Publishers, 2000. Klein, Aaron J. Striking Back: The 1972 Munich Olympics Massacre and Israel’s Deadly Response. Random House: New York, 2005. Kohlmann, Evan F. “The Real Online Terrorist Threat.” Foreign Affairs. Vol. 85 No. 5. (September 2006 - October 2006). Kurz, Anat N. Fatah and the Politics of Violence: The Institutionalization of a Popular Struggle. Sussex Academic Press: Brighton, 2005. LaBelle, G.G. “Abdel-Rahman’s Following in Egypt.” The Associated Press. (July 18, 1993). LaBelle, G.G. “Charges of Terrorism, Claims of Democracy Mix Blur of Sudan.” The Associated Press. (March 28, 1996). Laffin, John. Fedayeen: The Arab-Israeli Dilemma. Cassell: London, 1973. Leites, Nathan and Charles Wolf, Jr., Rebellion and Authority: An Analytical Essay on Insurgent Conflicts, The RAND Corporation, Markham Publishing Company, Chicago: 1970. Lowry, Ritchie P. “Toward a Sociology of Secrecy and Security Systems.” Social Problems. Vol. 19, No. 4. (Spring, 1972). M.L.R. Smith, Fighting for Ireland? The Military Strategy of the Irish Republican Movement. Routledge: London, 1995. Maloney, Ed. A Secret History of the IRA. W.W. Norton Company: New York, 2002. Manheim, Jarol B., Robert B. Albritton, “Insurgent Violence versus Image Management: The Struggle for National Images in Southern Africa.” British Journal of Political Science. Vol. 17, No. 2. (Apr. 1987). Margasak, Larry. “Philippines reports show terrorists' careful plans.” The Associated Press. (April 7, 2003). Marion, Russ and Mary Uhl-Bien, “Complexity Theory and al Qaeda: Examining Complex Leadership.” Presented at Managing the Complex IV: A Conference on
394
Complex Systems and the Management of Organizations. Fort Meyers, FL, December, 2002. Marx, Gary T. “Thoughts on a Neglected Category of Social Movement Participant: The Agent Provocateur and the Informant.” The American Journal of Sociology. Vol. 80, No. 2. (Sep. 1974). McCormick, G.H. and G. Owen, “Security and Coordination in a Clandestine Organization.” Mathematical and Computer Modeling. Vol 31, 2000. Meade, Robert Jr. Red Brigades: The Story of Italian Terrorism. MacMillan: London, 1990. Mekki, Hassan. “Security forces kill top militant in new blow to fundamentalists.” Agence France Presse. November 17, 1994. Mileti, Dennis S., Doug A. Timmer, David F. Gillespie. “Intra and Interorganizational Determinants of Decentralization.” The Pacific Sociological Review. Vol. 25, No. 2. (Apr., 1982). Miller, John and Michael Stone, with Chris Mitchell. The Cell: Inside the 9/11 Plot, and Why the FBI and CIA Failed to Stop It. Hyperion: New York, 2003. Mohammad Rashed Daoud Al-Owhali Interrogation, U.S. v Moussaoui Cr. No 01-455-A, Defendant’s Exhibit 767. Montasser Al-Zayyat. The Road to Al-Qaeda: The Story of bin Ladin’s Right Hand Man. Pluto Press: London, 2004. Moore, Joan, Diego Vigil, Robert Garcia. “Residence and Territoriality in Chicano Gangs.” Social Problems. Vol. 31, No. 2. (Dec. 1983). Moore, Robin. The Hunt for Bin Ladin: Task Force Dagger. Random House: New York, 2003. Moore, Will H. “Rational Rebels: Overcoming the Free-Rider Problem.” Political Research Quarterly. Vol. 48, No. 2. (Jun.1995). Murphy, Caryle. Passion for Islam: Shaping the Modern Middle East: The Egyptian Experience. Scribner: New York, 2002. Nojumi, Neamatollah. The Rise of the Taliban in Afghanistan. Palgrave: New York, 2002.
395
O’Ballance, Edgar. Arab Guerilla Power: 1967-1972. Archon Books: London, 1973. O’Brien, Brendan. The Long War: The IRA and Sinn Fein 1985 to Today. O’Brien Press: Dublin, 1993. O’Callaghan, Sean. The Informer. Bantam Press: London, 1998. O’Neill, Bard. Insurgency: A Framework for Analysis, in Insurgency in the Modern World. eds. Bard O’Neill, William Heaton, Donald Alberts Boulder: Westview Press, 1980. Oberschall, Anthony. “Explaining Terrorism: The Contribution of Collective Action Theory.” Sociological Theory. Vol. 22, No. 1, Theories of Terrorism: A Symposium, Mar. 2004. Pedahzur, Ami, Arie Perliger. “The Changing Nature of Suicide Attacks: A Social Network Perspective.” Social Forces,. Vol. 84, Iss. 4, Chapel Hill: Jun 2006. Pershing, Jana L. “To Snitch or Not to Snitch? Applying the Concept of Neutralization Techniques to the Enforcement of Occupational Misconduct.” Sociological Perspectives. Vol. 46, No. 2., (Summer 2003). Posner, Steve. Israel Undercover: Secret Warfare and Hidden Diplomacy in the Middle East. Syracuse University Press: New York, 1987. Raymond Gilmour, Dead Ground: Infiltrating the IRA. Little Brown and Company, London, 1998. Reed, Stanley. “The Battle for Egypt.” Foreign Affairs. (September/October 1993). Reeve, Simon. One Day in September. Arcade Publishing: New York, 2000. Reeve, Simon. The New Jackals: Ramzi Yousef, Osama bin Laden and the Future of Terrorism. Northeastern University Press: Boston, 1999. Regan, Patrick M., Daniel Norton. “Greed, Grievance, and Mobilization in Civil Wars.” The Journal of Conflict Resolution. Vol. 49, Iss. 3. Beverly Hills: (Jun 2005). Reichman, Nancy. “Breaking Confidences: Organizational Influences on Insider Trading.” The Sociological Quarterly. Vol. 30, No. 2, (Summer, 1989). Ronfeldt, David, and John Arquilla. Networks and Netwars: The Future of Terror, Crime and Militancy. The Rand Corporation, 2001.
396
Roucek, Joseph S. “Sociology of Secret Societies.” American Journal of Economics and Sociology. Vol. 19, No. 2. (Jan. 1960). Rubin, Barry and Judith Colp Rubin. Yasir Arafat: A Political Biography. Oxford University Press: Oxford, 2003. Rubin, Barry. Islamic Fundamentalism in Egyptian Politics. St. Martin’s Press: New York, 1990. Sageman, Marc. Understanding Terror Networks. University of Pennsylvania Press: Philadelphia, 2004. Sammakia, Nejla. “Islamic Fundamentalists Gain Strength in Egypt.” Human Rights Watch. July 18, 1992. Schanzer, Jonathan. Al Qaeda’s Armies: Middle East Affiliate Groups and the Next Generation of Terror. Specialist Press International: Washington, DC, 2005. Scheuer, Michael. “The New York Plot: The Impact of Bin Laden's Campaign to Inspire Jihad.” Terrorism Focus. Volume III, Issue 28, (July 18, 2006). Scheuer, Michael. Through Our Enemies’ Eyes: Osama bin Ladin, Radical Isalm, and the Future of America. Potomac Books: Washington, DC, 2006. Schiff, Zeev and Raphael Rothstein. Fedayeen: Guerrillas Against Israel. David McKay and Company, Inc: New York, 1972. Schulz, Helena Lindholm with Juliane Hammer. The Palestinian Diaspora: Formation of Identities and Politics of Homeland. Routledge, Taylor and Francis Group: London, 2003. Seale, Patrick. Abu Nidal: A Gun For Hire. Random House, New York, 1992. Shultz, Richard. “Breaking the Will of the Enemy during the Vietnam War: The Operationalization of the Cost-Benefit Model of Counterinsurgency Warfare.” Journal of Peace Research. Vol. 15, No. 2. (1978). Sims, Jennifer. “Understanding Friends and Enemies: The Context for American Intelligence Reform.” in Transforming U.S. Intelligence. eds Jennifer Sims and Burton Gerber, Georgetown University Press, DC, (2005). Smucker, Philip. Al Qaeda’s Great Escape: The Military and the Media on Terror’s Trail. Brassey’s, Inc.: Washington DC, 2004.
397
Staff Report of the National Commission on Terrorist Attacks Upon the United States, Monograph on Terrorist Financing. Staw, Barry M., Eugene Szwajkowski. “The Scarcity-Munificence Component of Organizational Environments and The Commission of Illegal Acts.” Administrative Science Quarterly. Vol. 20, No. 3, (Sep., 1975). Sullivan, Denis J. and Sana Abed-Kotob. Islam in Contempory Egypt: Civil Society vs. the State. Lynn Rienner Publishers: London, 1999. Tal, Nachman. Radical Islam in Egypt and Jordan. Sussex Academic Press: Brighton, 2005. Tarazona_Sevillano, Gabriela. “Sendero Luminoso and the Threat of Narcoterrorism.” CSIS, Washington Papers. Praeger: New York, 1990. Taylor, Peter. Beating the Terrorists? Interrogation at Omagh, Gough and Castlereagh. Penguin Books, Middlesex, UK: 1980. Taylor, Peter. Brits: The War Against the IRA. Bloomsbury, London, 2001. Taylor, Peter. Provos: The IRA and Sinn Fein. Bloomsbury, London, 1997. Teague, Matthew. “Double Blind: The Untold Story of How British Intelligence Infiltrated and Undermined the IRA.” The Atlantic Monthly. (April 2006). Thomas, Timothy. “Al Qaeda and the Internet: The Danger of ‘Cyberplanning’.” Parameters, (Spring 2003): pp. 112 – 123. Ulin, Robert C. “Peasant Politics and Secret Societies: The Discourse of Secrecy.” Anthropological Quarterly. Vol. 59, No. 1, (Jan., 1986). Ulph, Stephen. “Intelligence War Breaks out on the Jihadi Forums.” Terrorism Monitor. Volume 3, Issue 14, (April 11, 2006). United States v. Ahmed Omar Abu Ali, Criminal Action No. 05-53 GBL. United States v. Ahmed Omar Abu Ali, Criminal No. 1:05CR53, Feb 2005. United States v. Ali Abdelseoud Mohamed, Sworn Affidavit of FBI Special Agent Daniel Coleman, Sept 1998. United States v. Iyman Faris, Statement of Facts, United States District Court for the District of Eastern Virginia, Criminal Case.
398
United States v. Jamal Ahmed Mohammed Ali Al Badawi and Fahd al-Quso, United States District Court Southern District of New York, S12 98 Cr. 1023 KTD, Grand Jury Charges. United States v. Usama Bin Laden et al., United States District Court Southern District of New York, S7 98 Cr. 1023. Vaughan, Diane. “The Dark Side of Organizations: Mistake, Misconduct, and Disaster.” Annual Review of Sociology. Vol. 25. (1999). Vaughan, Diane. “Transaction Systems and Unlawful Organizational Behavior.” Social Problems. Vol. 29, No. 4. (Apr., 1982). Venzke, Ben. Evolution of Jihadi Video V1.0. Intelcenter, 11 May, 2005. Venzke, Ben. Jihadi Master Video Guide v1.1. 18 May 2006. Vidino, Lorenzo. Al Qaeda in Europe: The New Battleground of International Jihad. Prometheus Books: New York, 2006. Vinci, Anthony. “The Problems of Mobilization in the Analysis of Armed Groups.” Parameters. Spring 2006. Weaver, Mary Anne. A Portrait of Egypt: A Journey Through the World of Miltant Islam. Farrar, Straus and Giroux: New York, 1999. Woodworth, Paddy. Dirty War, Clean Hands: ETA, the GAL and Spanish Democracy. Cork University Press, Cork Ireland, 2001. Wright, Lawrence. The Looming Tower: Al-Qaeda and the Road to 9/11. Alfred Knopf: New York, 2006. Yaari, Ehud. Strike Terror: The Story of Fatah. Sabra Books, New York: 1970.